Skip to content

Enforce runtime configuration and CI contracts - #22

Merged
builtbyrishabh merged 4 commits into
mainfrom
launch/15-config-ci
Jul 17, 2026
Merged

Enforce runtime configuration and CI contracts#22
builtbyrishabh merged 4 commits into
mainfrom
launch/15-config-ci

Conversation

@builtbyrishabh

@builtbyrishabh builtbyrishabh commented Jul 17, 2026

Copy link
Copy Markdown
Owner

Refs #15

User-facing problem

Critical provider configuration was validated only when individual routes executed, root checks were poisoned by an unrelated untracked project, and no automated CI/test contract existed.

Implementation summary

  • Add a complete, testable environment schema covering database, Clerk, Upstash, R2, AI, Stripe, admin, Remotion, app URL, and production Inngest credentials.
  • Replace direct application process.env reads with typed env access; only the env loader and platform-controlled client bootstrap values remain direct.
  • Complete .env.example with safe placeholders and requirement comments.
  • Exclude the protected untracked field-guide project from root TypeScript discovery.
  • Add Vitest and environment validation tests.
  • Add GitHub Actions gates for frozen install, typecheck, lint, formatting, tests, production build, and high-severity audit.
  • Establish a clean formatting baseline for tracked source.
  • Apply compatible security updates for Clerk 6, AWS SDK, Inngest 4, ElevenLabs 2, and Drizzle Kit.

Migration notes

No database migration. Deployment environments must add every newly required key before this branch is deployed. Inngest signing/event keys are mandatory when NODE_ENV=production.

Security invariants

Malformed or missing Stripe, app URL, Remotion, storage, auth, and provider configuration fails startup/build validation. CI uses placeholders only; no production credentials are committed. Critical audit findings were reduced from 5 to 0.

Tests run

  • PASS: pnpm install --frozen-lockfile
  • PASS: pnpm typecheck
  • PASS: pnpm lint with non-secret production Inngest placeholders
  • PASS: pnpm format:check
  • PASS: pnpm test (7 environment-schema tests)
  • PASS: production pnpm build (18 routes)
  • PASS: CI YAML formatted and statically reviewed

Checks not run / blocking concern

  • BLOCKED: pnpm audit --audit-level high still reports 31 high-severity transitive/direct findings after all critical findings were removed. Major remaining sources include Next 15, Remotion, and development toolchains without compatible patched resolutions. The CI gate intentionally remains at high severity and will report failure; it was not weakened or suppressed. A Next 16/toolchain security-upgrade follow-up is required before paid public launch.
  • NOT RUN: CI on GitHub-hosted runners until this PR is opened.
  • NOT RUN: deployment or production secret validation.

Stack dependency and merge order

Stack PR 3 of 5. Base: launch/14-cost-guardrails. Merge #13, #14, #15, #16, then #19.

Known limitations

NODE_ENV, VERCEL_URL, and PORT remain direct reads in the client bootstrap because they are framework/platform controls. SKIP_ENV_VALIDATION remains available as an explicit build control and must not be used in production.

Rollback implications

Reverting removes startup guarantees and CI gates. Dependent lifecycle/verification PRs assume Vitest and the corrected TypeScript boundary, so revert them first.

🤖 Generated with Claude Code

@vercel

vercel Bot commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
anime-room Ready Ready Preview, Comment Jul 17, 2026 2:40pm

@coderabbitai

coderabbitai Bot commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@D33ADLOCK, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Free

Run ID: b5910ff1-45d9-4ebb-99a7-93adbb9c9f07

📥 Commits

Reviewing files that changed from the base of the PR and between 7c7ef77 and 234e57d.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (59)
  • .env.example
  • .github/workflows/ci.yml
  • package.json
  • src/app/(dashboard)/_components/creditBalance.tsx
  • src/app/(dashboard)/videos/discover/discoverGrid.tsx
  • src/app/(dashboard)/videos/discover/discoverOverlay.tsx
  • src/app/(public)/page.tsx
  • src/app/admin/_components/AdminNavbar.tsx
  • src/app/admin/page.tsx
  • src/app/api/webhooks/stripe/route.ts
  • src/app/payment/cancel/page.tsx
  • src/app/payment/success/page.tsx
  • src/components/ui/button.tsx
  • src/components/ui/collapsible.tsx
  • src/components/ui/dialog.tsx
  • src/components/ui/form.tsx
  • src/components/ui/input.tsx
  • src/components/ui/label.tsx
  • src/components/ui/separator.tsx
  • src/components/ui/sheet.tsx
  • src/components/ui/sidebar.tsx
  • src/components/ui/skeleton.tsx
  • src/components/ui/sonner.tsx
  • src/components/ui/textarea.tsx
  • src/components/ui/tooltip.tsx
  • src/config/credits/package.ts
  • src/env.js
  • src/env.schema.js
  • src/env.schema.test.ts
  • src/hooks/use-mobile.ts
  • src/lib/ai/chatterbox.ts
  • src/lib/ai/elevenLabsReplicate.ts
  • src/lib/ai/imageReplicate.ts
  • src/lib/ai/removebackground.ts
  • src/lib/constant.ts
  • src/lib/pipeline/helper/createCommonPreviewAssets.ts
  • src/lib/realtime/safeRealtimeEmit.ts
  • src/lib/redis/redis.ts
  • src/lib/remotionLambda/renderVideo.ts
  • src/lib/storage/client.ts
  • src/lib/storage/genPresignedUrl.ts
  • src/lib/storage/r2.ts
  • src/lib/storage/saveBufferToR2.ts
  • src/lib/storage/saveUsingUrl.ts
  • src/lib/storage/upload.ts
  • src/lib/storage/uploadCommonAssets.ts
  • src/lib/storage/uploadSkillIcons.ts
  • src/lib/stripe/stripe.ts
  • src/lib/utils.ts
  • src/remotion/components/Background.tsx
  • src/remotion/components/Caption.tsx
  • src/remotion/components/EgoBar.tsx
  • src/remotion/components/Skills.tsx
  • src/remotion/components/StatCard.tsx
  • src/remotion/components/Title.tsx
  • src/server/api/routers/payment.ts
  • src/server/api/trpc.ts
  • tsconfig.json
  • vitest.config.ts

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

Comment @coderabbitai help to get the list of available commands.

@builtbyrishabh
builtbyrishabh force-pushed the launch/14-cost-guardrails branch from 66049b2 to 279fe7a Compare July 17, 2026 14:32
@builtbyrishabh
builtbyrishabh changed the base branch from launch/14-cost-guardrails to main July 17, 2026 14:36
builtbyrishabh and others added 4 commits July 17, 2026 20:07
@builtbyrishabh @claude
Enforce runtime configuration and CI contracts
b07be60 
Co-Authored-By: Claude <noreply@anthropic.com>
@builtbyrishabh @claude
Use a valid non-secret Clerk CI key
1102235 
Co-Authored-By: Claude <noreply@anthropic.com>
@builtbyrishabh
Patch high-severity dependency vulnerabilities
0759a4c 
next was pinned below the patched 15.5.16 line (multiple high-severity
advisories); drizzle-orm, ws, hono, and several eslint-toolchain
transitives were also behind their patched versions. Bumps next/
drizzle-orm directly and pins the rest via pnpm overrides so
`pnpm audit --audit-level high` passes.
@builtbyrishabh
Retrigger Vercel deployment with Remotion env vars
234e57d
@builtbyrishabh
builtbyrishabh merged commit 2f09378 into main Jul 17, 2026
3 of 4 checks passed
@builtbyrishabh
builtbyrishabh deleted the launch/15-config-ci branch July 17, 2026 14:52

This branch was successfully deployed

1 active deployment
Preview — 234e57d8 Deployed Jul 17, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@builtbyrishabh