Repository navigation
fix(previews): inject project env at runtime, with PREVIEW_ overrides - #259
Merged
Merged
Conversation
PR previews read their env with a query on a non-existent column (project_env_vars.preview); the error was swallowed, so the container only got DEVFORGE_PREVIEW* and apps failed on missing runtime vars. Previews now get the project env like prod, then: - PREVIEW_<KEY> overrides <KEY> (e.g. a separate preview database), - *_REDIRECT_URI / *_REDIRECT_URL point to the preview host (same path), - DEVFORGE_PREVIEW* markers cannot be spoofed. A warning is logged when a preview shares the prod database.
… the preview host
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
PR preview containers started without the project's env vars (e.g. Vigie preview-6:
Variables runtime manquantes: TURSO_* ; OIDC_*), while prod got them.Root cause
load_preview_env_fileselected... WHERE preview = trueonproject_env_vars, but that column does not exist (the opt-in column ispreview_allowed). The SQL error was swallowed byunwrap_or_default(), so the generated.envonly heldDEVFORGE_PREVIEW*. The log line[env] cloned project env → .envwas printed anyway.Fix
Previews now build their runtime env from the project vars, like prod (fork PRs are still never deployed). The env is still passed at runtime via
--env-file, the same way as prod, and nothing is added to the image.PREVIEW_<KEY>overrides<KEY>in previews and is not passed under its own name. For example,PREVIEW_TURSO_DATABASE_URL/PREVIEW_TURSO_AUTH_TOKENpoint a preview at a separate database. No databases are created automatically.*_REDIRECT_URI/*_REDIRECT_URLvalues, and any URL value whose host is the project's production host (AUTH_URL,NEXTAUTH_URL, …), are rewritten to the preview host, keeping path and query (unless overridden byPREVIEW_<KEY>). Other hosts (for example the OIDC issuer) are kept as they are.DEVFORGE_PREVIEW,DEVFORGE_PREVIEW_PRandDEVFORGE_PREVIEW_URLare always set by DevForge and cannot be overridden.TURSO_DATABASE_URL,DATABASE_URL, … with noPREVIEW_override).Tests
Pure
build_preview_env/rewrite_url_host/preview_shared_db_keystests inpr_previews_tests.rs.