fix(n8n): register missing env vars in bootstrap registry and compose - #1196
Conversation
- registry.json: add AGENT_ZERO_EVENTS_TOKEN (agent-zero service, env.tier-agent) — used by approval_poller x-agent-token header - registry.json: add GH_WEBHOOK_SECRET (github-app service, env.shared) — used by webhook processor HMAC verification - docker-compose.n8n.yml: add DISCORD_WEBHOOK_URL, GH_WEBHOOK_SECRET, AGENT_ZERO_EVENTS_TOKEN, SUPABASE_SERVICE_ROLE_KEY to n8n container environment block (were only available via compose --env-file CLI interpolation, not inside the container) - patterns.yaml: add docker-compose.n8n to chitSafePaths for infra edits - github_webhook_processor.json: update NATS stub comment to recommend a2ui-nats-bridge HTTP pattern (deferred to feat/n8n-nats-bridge) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds Changes
Sequence Diagram(s)(Skipped — changes are primarily config, registry, and a documentation string; no new multi-component control flow implemented.) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Docker Hardening ValidationHardening Validation ReportValidated: Wed Apr 8 22:58:40 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/bootstrap/registry.json`:
- Around line 1239-1243: The help text for AGENT_ZERO_EVENTS_TOKEN incorrectly
states it is auto-generated by brand_defaults.py; update the "help" string for
the AGENT_ZERO_EVENTS_TOKEN entry so it accurately reflects current behavior:
state that the token is NOT auto-generated by brand_defaults.py, that operators
must supply a non-empty token if they want approval_poller to send the
x-agent-token header (otherwise approval_poller will send an empty header), and
optionally point to the correct generation mechanism or leave instructions for
creating the token; modify the registry.json entry for key
"AGENT_ZERO_EVENTS_TOKEN" (file "pmoves/env.tier-agent") accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4aa101e5-b721-42f7-96da-f6903a9544f6
📒 Files selected for processing (4)
.claude/hooks/damage-control/patterns.yamlpmoves/bootstrap/registry.jsonpmoves/docker-compose.n8n.ymlpmoves/n8n/flows/github_webhook_processor.json
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e10b6b429
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Two coordinated fixes for PR #1196 review threads: 1. docker-compose.n8n.yml: mirror the main compose's x-env-tier-worker anchor structure to load env.shared first, then env.tier-worker. Previously the local anchor only loaded env.tier-worker, which is why the PR added an environment-block override for DISCORD_WEBHOOK_URL, GH_WEBHOOK_SECRET, AGENT_ZERO_EVENTS_TOKEN, and SUPABASE_SERVICE_ROLE_KEY. Those overrides then empty-stringed working secrets when n8n is started standalone without shell env (compose environment: takes precedence over env_file:). Fix: expand the env_file list and remove the 4 redundant environment entries. Secrets flow naturally from env.shared via the bootstrap registry + secrets-funnel pipeline. 2. brand_defaults.py: implement AGENT_ZERO_EVENTS_TOKEN auto-generation in _ensure_agent_zero_defaults(). The registry.json help text ("Auto-generated by brand_defaults.py if blank") previously overstated this — no auto-gen existed. Now it does, matching the MCP_CLIENT_SECRET pattern in the same function. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Docker Hardening ValidationHardening Validation ReportValidated: Thu Apr 9 18:42:49 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
Rebased from ea7f24d onto updated main after #1193/#1194/#1196/#1201 merges. 1. pr_monitor.py: _repo_name() prefers origin remote URL over gh repo view. On fork+upstream checkouts, gh auto-detect returns upstream (openclaw) instead of origin (POWERFULMOVES). Parses SSH + HTTPS URL formats. Changed --base default from PMOVES.AI-Edition-Hardened to main. 2. preflight.mk: pr-monitor and pr-monitor-strict targets now forward PR_MONITOR_REPO as --repo and default PR_MONITOR_BASE to main. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 participants
Summary
AGENT_ZERO_EVENTS_TOKEN(agent-zero service) andGH_WEBHOOK_SECRET(github-app service) to bootstrap manifest — both were used in n8n flows but not registered, making them invisible toenv-setupandsecrets-funnelDISCORD_WEBHOOK_URL,GH_WEBHOOK_SECRET,AGENT_ZERO_EVENTS_TOKEN,SUPABASE_SERVICE_ROLE_KEY) — these were only available via compose--env-fileCLI interpolation, not injected into the containerdocker-compose.n8nto chitSafePaths for z890-claude infra editsa2ui-nats-bridgeHTTP pattern (actual bridge deferred tofeat/n8n-nats-bridge)Context
Discovered during PR #1194 review trim — the n8n flows reference env vars that were never registered in the bootstrap manifest or exposed to the n8n container. Without these,
approval_poller.jsonsilently sends emptyx-agent-tokenheaders andgithub_webhook_processor.jsonfails HMAC verification.Test plan
python -c "import json; data=json.load(open('pmoves/bootstrap/registry.json')); keys={v['key'] for svc in data['services'] for v in svc['variables']}; assert 'AGENT_ZERO_EVENTS_TOKEN' in keys; assert 'GH_WEBHOOK_SECRET' in keys; print('OK')"grep -c 'AGENT_ZERO_EVENTS_TOKEN\|GH_WEBHOOK_SECRET\|DISCORD_WEBHOOK_URL\|SUPABASE_SERVICE_ROLE_KEY' pmoves/docker-compose.n8n.ymlreturns 4python -c "import json; json.load(open('pmoves/n8n/flows/github_webhook_processor.json')); print('valid')"— JSON valid🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation