fix: pass runtime env vars to Vercel deploy#350
Conversation
|
Warning Rate limit exceeded@saddlepaddle has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 23 minutes and 3 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (2)
WalkthroughAdded propagation of multiple environment variables into Vercel deploy commands in GitHub Actions for both production and preview workflows, injecting secrets and URLs (e.g., CLERK_, DATABASE_URL, BLOB_READ_WRITE_TOKEN, NEXT_PUBLIC_* ) into prebuilt deployments. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🧹 Preview Cleanup CompleteThe following preview resources have been cleaned up:
Thank you for your contribution! 🎉 Preview resources have been processed for cleanup |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/deploy-production.yml (1)
66-85: Possible missing runtime env:DATABASE_URL_UNPOOLEDis set but not deployed
Indeploy-apiyou exportDATABASE_URL_UNPOOLED(Line 72) but don’t pass it via--env. If any runtime code expects it, this will remain broken.vercel deploy --prod --prebuilt --token="$VERCEL_TOKEN" \ --env CLERK_SECRET_KEY="$CLERK_SECRET_KEY" \ --env CLERK_WEBHOOK_SECRET="$CLERK_WEBHOOK_SECRET" \ --env DATABASE_URL="$DATABASE_URL" \ + --env DATABASE_URL_UNPOOLED="$DATABASE_URL_UNPOOLED" \ --env BLOB_READ_WRITE_TOKEN="$BLOB_READ_WRITE_TOKEN"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/deploy-production.yml(4 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Deploy Web
- GitHub Check: Deploy Marketing
- GitHub Check: Deploy Docs
- GitHub Check: Deploy API
- GitHub Check: Deploy Admin
- GitHub Check: Build
🔇 Additional comments (5)
.github/workflows/deploy-production.yml (5)
130-132: Keep env propagation consistent (and quote values)
Same notes as API: quote values; also consider whetherDATABASE_URL_UNPOOLEDis required at runtime for Web (it’s present in env but not deployed).- vercel deploy --prod --prebuilt --token=$VERCEL_TOKEN \ - --env CLERK_SECRET_KEY=$CLERK_SECRET_KEY \ - --env DATABASE_URL=$DATABASE_URL + vercel deploy --prod --prebuilt --token="$VERCEL_TOKEN" \ + --env CLERK_SECRET_KEY="$CLERK_SECRET_KEY" \ + --env DATABASE_URL="$DATABASE_URL"
174-175: Marketing deploy: verify Clerk secret is actually needed server-side
If Marketing is purely static/CSR, injectingCLERK_SECRET_KEYis unnecessary risk; if there are serverless routes using Clerk server SDK, then this is correct—please confirm.
219-221: Admin deploy: same consistency/quoting + checkDATABASE_URL_UNPOOLED
Quote values and confirm which DB URL variant Admin needs at runtime; right now onlyDATABASE_URLis deployed.- vercel deploy --prod --prebuilt --token=$VERCEL_TOKEN \ - --env CLERK_SECRET_KEY=$CLERK_SECRET_KEY \ - --env DATABASE_URL=$DATABASE_URL + vercel deploy --prod --prebuilt --token="$VERCEL_TOKEN" \ + --env CLERK_SECRET_KEY="$CLERK_SECRET_KEY" \ + --env DATABASE_URL="$DATABASE_URL"
81-85: Overall direction looks right for the reported “Missing secretKey” incident
The change matches the stated root cause (runtime envs missing in serverless). Once the flag semantics and completeness are verified, this should unblock production.Also applies to: 130-132, 174-175, 219-221
81-85: Runtime environment variables withvercel deploy --prebuiltare correctly configured using--env
The--envflag (as used in lines 81–85) correctly sets environment variables for the runtime of the deployment (serverless functions and server-side code). This is the appropriate choice for passing secrets likeCLERK_SECRET_KEY,DATABASE_URL, andBLOB_READ_WRITE_TOKENat runtime;--envworks as expected with the--prebuiltflag and does not require--build-envunless the values are needed during the build step itself.
| vercel deploy --prod --prebuilt --token=$VERCEL_TOKEN \ | ||
| --env CLERK_SECRET_KEY=$CLERK_SECRET_KEY \ | ||
| --env CLERK_WEBHOOK_SECRET=$CLERK_WEBHOOK_SECRET \ | ||
| --env DATABASE_URL=$DATABASE_URL \ | ||
| --env BLOB_READ_WRITE_TOKEN=$BLOB_READ_WRITE_TOKEN |
There was a problem hiding this comment.
Quote env values + consider CLI-arg secret exposure
Passing secrets as CLI args is workable but brittle; at minimum quote values (and ideally prefer storing secrets in Vercel project env vars so they aren’t present in command lines).
- vercel deploy --prod --prebuilt --token=$VERCEL_TOKEN \
- --env CLERK_SECRET_KEY=$CLERK_SECRET_KEY \
- --env CLERK_WEBHOOK_SECRET=$CLERK_WEBHOOK_SECRET \
- --env DATABASE_URL=$DATABASE_URL \
- --env BLOB_READ_WRITE_TOKEN=$BLOB_READ_WRITE_TOKEN
+ vercel deploy --prod --prebuilt --token="$VERCEL_TOKEN" \
+ --env CLERK_SECRET_KEY="$CLERK_SECRET_KEY" \
+ --env CLERK_WEBHOOK_SECRET="$CLERK_WEBHOOK_SECRET" \
+ --env DATABASE_URL="$DATABASE_URL" \
+ --env BLOB_READ_WRITE_TOKEN="$BLOB_READ_WRITE_TOKEN"🤖 Prompt for AI Agents
In .github/workflows/deploy-production.yml around lines 81 to 85, the workflow
is passing secrets directly as unquoted CLI environment arguments to the vercel
deploy command; at minimum wrap each env value in quotes (e.g., "--env
CLERK_SECRET_KEY=\"$CLERK_SECRET_KEY\"") to avoid word-splitting and shell
interpretation, and preferably stop passing secrets on the command line
altogether by provisioning those secrets as Vercel project/environment variables
(or using vercel's secure env APIs) and removing them from the CLI invocation so
secrets are not exposed in process lists or logs.
saddlepaddle
force-pushed
the
zygotic-dragonfly-50f626
branch
from
3c81bc0 to
8fed9cd
Compare
saddlepaddle
force-pushed
the
zygotic-dragonfly-50f626
branch
from
8fed9cd to
ac3ea1c
Compare
Server-side environment variables (CLERK_SECRET_KEY, DATABASE_URL, etc.) were only available at build time, not runtime. This caused Clerk auth to fail in production. Added --env flags to vercel deploy commands to pass these variables to the serverless function runtime. Updated both production and preview workflows. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
saddlepaddle
force-pushed
the
zygotic-dragonfly-50f626
branch
from
ac3ea1c to
f64be8c
Compare
1 participant
Summary
Missing secretKey)--envflags tovercel deploycommands to pass runtime variables to serverless functionsTest plan
🤖 Generated with Claude Code
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.