Skip to content

fix(ci): unblock deploy pipeline — lint, test, and marketing build #3577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kitenite wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(ci): unblock deploy pipeline — lint, test, and marketing build #3577

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/deploy-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,11 +461,13 @@ jobs:
SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }}
SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
DATABASE_URL: ${{ secrets.DATABASE_URL }}
run: |
vercel pull --yes --environment=preview --token=$VERCEL_TOKEN
vercel build --token=$VERCEL_TOKEN
VERCEL_URL=$(vercel deploy --prebuilt --archive=tgz --token=$VERCEL_TOKEN \
--env BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET \
--env DATABASE_URL=$DATABASE_URL \
--env NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
--env NEXT_PUBLIC_WEB_URL=$NEXT_PUBLIC_WEB_URL \
--env NEXT_PUBLIC_MARKETING_URL=$NEXT_PUBLIC_MARKETING_URL \
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/deploy-production.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,11 +320,13 @@ jobs:
SLACK_BILLING_WEBHOOK_URL: ${{ secrets.SLACK_BILLING_WEBHOOK_URL }}
SECRETS_ENCRYPTION_KEY: ${{ secrets.SECRETS_ENCRYPTION_KEY }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
DATABASE_URL: ${{ secrets.DATABASE_URL }}
run: |
vercel pull --yes --environment=production --token=$VERCEL_TOKEN
vercel build --prod --token=$VERCEL_TOKEN
vercel deploy --prod --prebuilt --archive=tgz --token=$VERCEL_TOKEN \
--env BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET \
--env DATABASE_URL=$DATABASE_URL \
Comment on lines +323 to +329
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Remove the production DB secret from the marketing deploy.

This reintroduces DATABASE_URL into the marketing workflow, which expands secret exposure and conflicts with the stated dynamic-import fix that avoids adding DB credentials. If the marketing runtime should fail gracefully when auth/server DB code is unavailable, don’t pass the app database URL here.

🔧 Proposed fix 
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
         run: |
           vercel pull --yes --environment=production --token=$VERCEL_TOKEN
           vercel build --prod --token=$VERCEL_TOKEN
           vercel deploy --prod --prebuilt --archive=tgz --token=$VERCEL_TOKEN \
             --env BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET \
-            --env DATABASE_URL=$DATABASE_URL \
             --env NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
DATABASE_URL: ${{ secrets.DATABASE_URL }}
run: |
vercel pull --yes --environment=production --token=$VERCEL_TOKEN
vercel build --prod --token=$VERCEL_TOKEN
vercel deploy --prod --prebuilt --archive=tgz --token=$VERCEL_TOKEN \
--env BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET \
--env DATABASE_URL=$DATABASE_URL \
run: |
vercel pull --yes --environment=production --token=$VERCEL_TOKEN
vercel build --prod --token=$VERCEL_TOKEN
vercel deploy --prod --prebuilt --archive=tgz --token=$VERCEL_TOKEN \
--env BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET \
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/deploy-production.yml around lines 323 - 329, The workflow
is passing DATABASE_URL into the marketing Vercel deploy which reintroduces
production DB exposure; remove the --env DATABASE_URL=$DATABASE_URL flag from
the vercel deploy invocation (and any DATABASE_URL entries in the surrounding
env mapping) so only BETTER_AUTH_SECRET is forwarded, and confirm the marketing
runtime (build/deploy logic) gracefully handles missing DB credentials when
auth/server DB code is dynamically omitted; locate the vercel deploy command and
the env block that currently reference DATABASE_URL to make this change.

--env NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
--env NEXT_PUBLIC_WEB_URL=$NEXT_PUBLIC_WEB_URL \
--env NEXT_PUBLIC_MARKETING_URL=$NEXT_PUBLIC_MARKETING_URL \
Expand Down
Loading