fix: harden Railway operations and staging checks#918
Conversation
Separate CI-only secrets from Railway parity, make worker restarts durable, enable the verified ops digest, and support the isolated offline staging profile. Focused tests, live staging checks, and manual GitHub workflow proofs passed; the broad local gate was blocked by another worktree's heavy-test lock.
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
📝 WalkthroughWalkthroughThe pull request updates worker restart behavior, scheduled operations, staging deployment documentation, provider-specific environment parity checks, and offline staging readiness validation. ChangesOperations and readiness
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b01140aec6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // UPPER_SNAKE tokens defensively. Names only. | ||
| const raw = execFileSync("railway", ["variables"], { encoding: "utf8" }); | ||
| return [...new Set([...raw.matchAll(/\b([A-Z][A-Z0-9_]{2,})\b/g)].map((m) => m[1]))]; | ||
| const raw = execFileSync("railway", ["variable", "list", "--json"], { encoding: "utf8" }); |
There was a problem hiding this comment.
When --railway is used, this command is not consuming a names-only listing: Railway's CLI source for variable list --json documents that JSON output "includes raw values" and serializes the key/value map (see railwayapp/cli src/commands/variable.rs). That means npm run check:env-parity -- --railway reads every runtime secret into the Node process despite this script's names-only/no-values contract, so any future debugging or capture around this command can expose production secrets; use a genuinely name-only source or avoid the value-bearing JSON path.
Useful? React with 👍 / 👎.
| - One staging `app` container and **no staging worker**. The active Railway | ||
| `Database` project has a `staging` environment pinned to Singapore with | ||
| `RAG_PROVIDER_MODE=offline`, isolated Supabase credentials, and no OpenAI key. | ||
| This keeps release proofs deterministic and prevents staging ingestion from |
There was a problem hiding this comment.
This new offline/no-key staging profile is still contradicted by docs/launch-operator-runbook.md:121-125, which tells operators to set OPENAI_API_KEY and RAG_PROVIDER_MODE=auto. When staging is recreated from that launch runbook, it will re-enable provider-backed paths and invalidate the deterministic/no-spend staging checks this change adds; update that runbook or point it at this offline profile.
Useful? React with 👍 / 👎.
1 participant
Summary
ALWAYSrestart policy.Verification
npm exec -- vitest run tests/repo-hygiene.test.ts tests/railway-config.test.ts tests/ops-digest.test.ts— 52 passednpm exec -- vitest run tests/check-indexing-contract.test.ts— 5 passednpm exec -- vitest run tests/production-readiness-offline.test.ts tests/supabase-project.test.ts— 12 passednpm run check:github-actionsandnpm run check:runtime— passednpm run check:env-parity -- --gh --railwayagainst production — passed, names onlynpm run check:supabase-project,npm run check:indexing, andnpm run check:production-readiness— passed/api/health/readyand/api/health— bothoknpm run verify:cheapVerification not run:
npm run verify:cheapwas attempted twice but both attempts were rejected by the repository-wide heavy-command lock while other worktrees ranverify:pr-local/verify:cheap:internal; required PR CI remains the full gate.Risk and rollout
ALWAYSwith no retry cap. A dedicated Sydney Supabase project and app-only Singapore Railway staging environment were provisioned. Staging is offline, has no worker or OpenAI key, and contains no production clinical data; only two synthetic tenancy-test users were created.Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Notes
check:default-aclrunner currently fails before execution because its top-level await is transformed to CommonJS onmain; direct RPC verification was used instead.postgresdefault ACLs verify safe.supabase_admindefaults still require the six reviewed statements from migration20260713102000in the Supabase SQL editor. CLI and Management API correctly reject that role-owned operation, and the available dashboard session had expired.