fix(ci): zera Credentials Audit (SSOT) + destrava edge-integration-all by adm01-debug · Pull Request #519 · adm01-debug/promo-gifts-v4

adm01-debug · 2026-05-29T21:38:27Z

Contexto

Triagem dos workflows vermelhos do main (advisory, não-bloqueantes). A Personalization E2E já voltou a verde sozinha (era flaky). Restavam 2 vermelhos reais, ambos corrigidos aqui.

1. Credentials Audit ❌→✅

Causa: supabase/functions/visual-search/index.ts lia HF_ACCESS_TOKEN via Deno.env.get() — bypass do SSOT (severidade HIGH, nova vs baseline).
Fix: usa resolveCredential("HF_ACCESS_TOKEN") (DB-first → env fallback), mesmo padrão de ai-recommendations/elevenlabs-*.
Verificação local: npm run audit:credentials → ✅ No new credential issues (exit 0).

2. edge-integration-all ❌→✅ (startup_failure)

Causa: o job edge-fuzz-live referenciava secrets.SUPABASE_SERVICE_ROLE_KEY num if: de nível de job. O contexto secrets não é permitido em if de job → o GitHub não compila o workflow → startup_failure (run com 0 jobs, nome exibido como o path do arquivo).
Fix: gate do job só em vars.SUPABASE_URL (permitido); secret mapeado para env do job e presença checada por if de step (env.SUPABASE_SERVICE_ROLE_KEY != ''). Preserva a intenção "só roda live com credenciais" sem quebrar a compilação.
Verificação local: YAML válido.

Escopo

2 arquivos, cirúrgico, sem mudança de comportamento de runtime do app. Não toquei na linha de LOVABLE_API_KEY (não flagada pelo audit) para evitar scope creep.

https://claude.ai/code/session_01QpLctApdgHrT7hBAS3dk71

Generated by Claude Code

Summary by cubic

Fixes CI by restoring the Credentials Audit (SSOT) and unblocking the edge-integration-all workflow. No runtime behavior changes.

Bug Fixes
- Credentials Audit: replace Deno.env.get("HF_ACCESS_TOKEN") with resolveCredential("HF_ACCESS_TOKEN") (DB-first → env fallback) in supabase/functions/visual-search/index.ts.
- edge-integration-all: remove disallowed secrets.* from job-level if:. Gate on vars.SUPABASE_URL, map secret to job env, and check presence with step-level if: to avoid startup_failure.

^{Written for commit afa8161. Summary will update on new commits.}

Summary by CodeRabbit

Notas da Versão

Chores
- Otimizado o tratamento de secrets no workflow de integração.
Refactor
- Melhorado o mecanismo de resolução de credenciais no endpoint de visual search.

…l (startup_failure) Triagem dos workflows vermelhos do main. 1) Credentials Audit — visual-search/index.ts lia HF_ACCESS_TOKEN via Deno.env.get() (bypass do SSOT, HIGH). Trocado por resolveCredential() (DB-first → env fallback), padrão já usado em ai-recommendations/elevenlabs. Audit volta a passar (0 new issues). 2) edge-integration-all.yml — job edge-fuzz-live usava secrets.* num if: de nível de job. O contexto 'secrets' não é permitido em if de job → o workflow inteiro falhava a compilar (startup_failure, 0 jobs, nome exibido como path). Gate movido para vars.SUPABASE_URL (permitido) + secret mapeado para env do job e presença checada via if de step (env.SUPABASE_SERVICE_ROLE_KEY != '').

coderabbitai · 2026-05-29T21:38:33Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1359b840-ae4b-40d3-b8c4-994b1bd8ab22

📥 Commits

Reviewing files that changed from the base of the PR and between 88e6970 and afa8161.

📒 Files selected for processing (2)

.github/workflows/edge-integration-all.yml
supabase/functions/visual-search/index.ts

Walkthrough

Este PR refatora a gestão de credenciais em dois contextos: ajusta o workflow CI para condicionar o job edge-fuzz-live sem usar secrets em if:, movendo a injeção de chaves para env do job; e migra o endpoint visual-search para resolver HF_ACCESS_TOKEN de forma assíncrona via resolveCredential em vez de leitura direta do ambiente.

Changes

Refatoração de gestão de credenciais

Layer / File(s)	Summary
Workflow CI: Job condicionais e injeção de env `.github/workflows/edge-integration-all.yml`	Job `edge-fuzz-live` remove `secrets` de condicional `if:` e adota `vars.SUPABASE_URL` como condição; `SUPABASE_SERVICE_ROLE_KEY` migra para `env` do job. Steps individuais se condicionam por presença de `env.SUPABASE_SERVICE_ROLE_KEY`; `SUPABASE_URL` resolve via `vars` com fallback para `secrets.VITE_SUPABASE_URL`.
Visual search: Async credential resolver `supabase/functions/visual-search/index.ts`	Importa `resolveCredential` e substitui `Deno.env.get("HF_ACCESS_TOKEN")` por chamada assíncrona `resolveCredential("HF_ACCESS_TOKEN")`, aplicando fallback DB-first.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Por quê: Mudanças de padrão bem delimitadas (workflow CI + una função edge) sem lógica densa. Workflow CI é ajuste estrutural de injeção de secrets; visual-search é substituição direta de acesso síncrono por resolver assíncrono. Ambas são mudanças pontuais e previsíveis.

Possibly related PRs

adm01-debug/promo-gifts-v4#355: Mesmo arquivo de workflow com ajustes no job edge-fuzz-live e condicionalização de Supabase env/secrets.
adm01-debug/promo-gifts-v4#458: Refactor similar em outras funções edge, migrando Deno.env.get para getCredential/vault; parte da mesma mudança de padrão de credential resolution.
adm01-debug/promo-gifts-v4#331: Ajustes anteriores no workflow edge-integration-all.yml para CI/runner que dependem da injeção correta de credenciais em modo dry-run/live.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/fix-ci-credentials-edge-integration

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

vercel · 2026-05-29T21:38:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
we-dream-big	Error		May 29, 2026 9:38pm

supabase · 2026-05-29T21:38:44Z

Updates to Preview Branch (claude/fix-ci-credentials-edge-integration) ↗︎

Deployments	Status	Updated
Database	🔄	Fri, 29 May 2026 21:38:41 GMT
Services	🔄	Fri, 29 May 2026 21:38:41 GMT
APIs	🔄	Fri, 29 May 2026 21:38:41 GMT

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	🔄	Fri, 29 May 2026 21:38:41 GMT
Migrations	🔄	Fri, 29 May 2026 21:38:41 GMT
Seeding	🔄	Fri, 29 May 2026 21:38:41 GMT
Edge Functions	🔄	Fri, 29 May 2026 21:38:41 GMT

Preview Branch Database Settings ↗︎.
Learn more about Supabase Branching ↗︎.

chatgpt-codex-connector · 2026-05-29T21:39:15Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

vercel Bot deployed to Preview May 29, 2026 21:38 View deployment

adm01-debug marked this pull request as ready for review May 29, 2026 21:39

Copilot AI review requested due to automatic review settings May 29, 2026 21:39

Copilot started reviewing on behalf of adm01-debug May 29, 2026 21:39 View session

adm01-debug merged commit d8a52dc into main May 29, 2026
36 of 47 checks passed

adm01-debug deleted the claude/fix-ci-credentials-edge-integration branch May 29, 2026 21:39

Copilot AI reviewed May 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ci): zera Credentials Audit (SSOT) + destrava edge-integration-all#519

fix(ci): zera Credentials Audit (SSOT) + destrava edge-integration-all#519
adm01-debug merged 1 commit into
mainfrom
claude/fix-ci-credentials-edge-integration

adm01-debug commented May 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 29, 2026 •

edited

Loading

Review failed

Uh oh!

vercel Bot commented May 29, 2026 •

edited

Loading

Uh oh!

supabase Bot commented May 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 29, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

adm01-debug commented May 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contexto

1. Credentials Audit ❌→✅

2. edge-integration-all ❌→✅ (startup_failure)

Escopo

Summary by cubic

Summary by CodeRabbit

Notas da Versão

Uh oh!

coderabbitai Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

vercel Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supabase Bot commented May 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 29, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adm01-debug commented May 29, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 29, 2026 •

edited

Loading

vercel Bot commented May 29, 2026 •

edited

Loading