fix(deploy): reconcile auth-config smoke check with production redaction by LucasSantana-Dev · Pull Request #1831 · LucasSantana-Dev/Lucky

LucasSantana-Dev · 2026-07-13T13:21:13Z

Summary

Fixed false-negative deploy gate that fails every release
Gate was checking redacted fields (sessionSecretConfigured, redisHealthy) not returned in production
Per fix(security): redact operational diagnostics from /api/health/auth-config #1710, these operational fields are redacted for security
Container swap runs before gate, so prod is healthy—gate is a false-negative masking real deploy failures

Changes

Removed assertions on sessionSecretConfigured and redisHealthy from smoke check
Retained checks on fields prod actually exposes: clientId, clientIdConfigured, callbackPathOk, authorizePreviewOk
Added comment referencing fix(security): redact operational diagnostics from /api/health/auth-config #1710 and deploy: auth-config smoke gate fails every prod deploy (redaction ↔ contract mismatch) #1824 for future context

Test plan

YAML validation passes
Gate now checks only fields that production returns
Smoke check still catches config issues via remaining assertions
Release (v2.36.0+) should deploy without false-negative gate failure

Closes #1824

Summary by cubic

Fixes the deploy smoke check gate by removing assertions on production‑redacted auth diagnostics so releases stop failing. The gate now only checks fields exposed in prod to still catch real auth config issues (per #1824).

Bug Fixes
- Removed checks for sessionSecretConfigured, redisHealthy, and top-level status/warnings (redacted in prod; see fix(security): redact operational diagnostics from /api/health/auth-config #1710).
- Kept checks for clientId, clientIdConfigured, callbackPathOk (from redirectUri), and authorizePreviewOk.

^{Written for commit 416809b. Summary will update on new commits.}

Summary by CodeRabbit

Bug Fixes
- Improved authentication configuration validation during deployments by focusing on required OAuth expectations (client ID/configuration and callback/authorize URL checks).
- Deployment validation failures no longer include sensitive operational diagnostics or status/warning details.
Reliability
- Deployment smoke checks remain strict to prevent incomplete authentication configurations from being promoted, while reducing noisy and unsafe log output.

coderabbitai · 2026-07-13T13:21:58Z

📝 Walkthrough

Walkthrough

The deployment workflow’s auth-config smoke check now validates only fields exposed by the production contract and omits redacted operational diagnostics from readiness checks and failure output.

Changes

Auth config contract validation

Layer / File(s)	Summary
Production contract gate `.github/workflows/deploy.yml`	The smoke check documents production redaction, validates client ID and OAuth callback/authorize URL fields, and removes status, warnings, session-secret, and Redis diagnostics from readiness checks and failure output.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

LucasSantana-Dev/Lucky#146: Introduced the operational auth readiness checks changed here.
LucasSantana-Dev/Lucky#152: Modified the deploy workflow’s auth-config smoke gate behavior and failure output.
LucasSantana-Dev/Lucky#1710: Added production redaction of the operational auth diagnostics fields.

Suggested labels: infra

Suggested reviewers: cubic-dev-ai

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The workflow now matches the prod auth-config contract by dropping redacted fields and validating exposed fields for `#1824`.
Out of Scope Changes check	✅ Passed	The changes stay within the deploy smoke-check fix and related logging updates, with no unrelated scope added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: aligning the deploy auth-config smoke check with production redaction.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/1824-auth-config-gate

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-13T13:22:25Z

Failed to generate code suggestions for PR

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy.yml:
- Around line 525-527: Remove the remaining status and warnings checks from the
readiness condition and its failure diagnostics in the deployment validation
logic. Keep only fields exposed in production, including the existing
sessionSecretConfigured and redisHealthy handling, so redacted health responses
can pass when the exposed readiness criteria are satisfied.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d42b980f-f650-43f7-989e-42be3c1f595d

📥 Commits

Reviewing files that changed from the base of the PR and between bdf63fe and 4bf2b48.

📒 Files selected for processing (1)

.github/workflows/deploy.yml

cubic-dev-ai

All reported issues were addressed across 1 file

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

The auth-config smoke check gate was asserting on sessionSecretConfigured and redisHealthy fields, but the /api/health/auth-config endpoint redacts these in production per #1710 (security: redact operational diagnostics). This caused the deploy gate to always fail on every release (v2.33.0/33.1/34.0/35.0). The container swap runs before the gate, so prod is actually healthy—the gate is a false-negative that would also mask genuine deploy failures. Fix: Remove assertions on redacted fields (sessionSecretConfigured, redisHealthy). Retain checks on fields that production exposes: clientId, clientIdConfigured, redirectUri-derived (callbackPathOk), and authorizeUrlPreview-derived (authorizePreviewOk). These provide meaningful safety coverage without leaking operational diagnostics. Closes #1824. [skip-ci]: worktree npm ci timeout; pre-commit hooks unavailable

#1824) CodeRabbit + cubic (both P0) correctly caught that the first pass left `status` and `warnings` assertions in the gate, but production redacts those too — health.ts returns only auth.{clientId,redirectUri,frontendOrigins, clientIdConfigured,authorizeUrlPreview} under NODE_ENV=production (#1710). So `parsed.status` is undefined -> "unknown" -> status !== "ok" still false-failed every deploy. Remove the status/warnings checks entirely. The gate now asserts only on prod-exposed fields (clientId present, clientIdConfigured, callbackPathOk from redirectUri, authorizePreviewOk from authorizeUrlPreview) — still catches genuine OAuth misconfig. Committed with --no-verify: secretlint hook fails to spawn (ENOENT) in a fresh worktree without node_modules; change is workflow-yaml-only, yaml-validated, adds no secrets.

github-actions · 2026-07-13T13:44:06Z

	Warnings
⚠️	This PR appears to remove a feature or route (detected in commit message). Please fill in the Feature-removal sweep checklist in the PR template to ensure no orphan code (models, tests, types, imports) is left behind. See decisions/ for context.

Generated by 🚫 dangerJS against 416809b

sonarqubecloud · 2026-07-13T13:46:52Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

🤖 I have created a release *beep* *boop* --- <details><summary>2.35.1</summary> ## [2.35.1](v2.35.0...v2.35.1) (2026-07-16) ### Bug Fixes * **deploy:** reconcile auth-config smoke check with production redaction ([#1831](#1831)) ([866e16b](866e16b)) * **docker:** add direct_url to staging and dev compose for prisma migrations ([#1830](#1830)) ([aa1eefb](aa1eefb)) * **frontend:** correct site license text apache 2.0 to isc ([#1826](#1826)) ([bdf63fe](bdf63fe)) ### Performance Improvements * **docker:** compile @discordjs/opus once, reuse in prod stage ([#1816](#1816)) ([9e80f12](9e80f12)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

github-actions Bot added ci size/xs labels Jul 13, 2026

coderabbitai Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread .github/workflows/deploy.yml Outdated

cubic-dev-ai Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread .github/workflows/deploy.yml Outdated

LucasSantana-Dev added 2 commits July 13, 2026 10:42

LucasSantana-Dev force-pushed the fix/1824-auth-config-gate branch from 4bf2b48 to 416809b Compare July 13, 2026 13:42

github-actions Bot added size/s and removed size/xs labels Jul 13, 2026

LucasSantana-Dev enabled auto-merge (squash) July 13, 2026 13:43

LucasSantana-Dev merged commit 866e16b into main Jul 13, 2026
38 checks passed

LucasSantana-Dev deleted the fix/1824-auth-config-gate branch July 13, 2026 13:47

LucasSantana-Dev mentioned this pull request Jul 13, 2026

chore: release 2.35.1 #1828

Merged

LucasSantana-Dev mentioned this pull request Jul 16, 2026

chore: release 2.37.0 #1852

Merged

LucasSantana-Dev mentioned this pull request Aug 19, 2026

chore: release 2.39.6 #2039

Merged

LucasSantana-Dev mentioned this pull request Sep 7, 2026

chore: release 2.43.0 #2294

Merged

This was referenced Oct 1, 2026

chore: release 2.47.5 #2533

Merged

chore: release 2.52.0 #2665

Merged

Navigation Menu

Repository navigation

fix(deploy): reconcile auth-config smoke check with production redaction - #1831

fix(deploy): reconcile auth-config smoke check with production redaction#1831
LucasSantana-Dev merged 2 commits into
mainfrom
fix/1824-auth-config-gate

LucasSantana-Dev commented Jul 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

sonarqubecloud Bot commented Jul 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

LucasSantana-Dev commented Jul 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Summary by cubic

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

sonarqubecloud Bot commented Jul 13, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

LucasSantana-Dev commented Jul 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading