Repository navigation
fix(ci): load prod deploy secrets from Infisical over GitHub OIDC - #355
Merged
Merged
Conversation
…adder The font stack named var(--font-inter), which nothing defines since the React app went, so the app rendered in the system font. It names Inter now, and 500 and 600 load beside 400. A first pass of rules taken from Shinsa's design system: - Tokens: fg-1..4 text ladder mixed from --fg (every gray palette gets its own), alpha washes, a field fill, a control highlight, faux-medium. - Sidebar: rows at rest are quieter and normal weight; hover is a wash; the current row a stronger wash plus faux-medium, so hover and current no longer look the same; unread rows step up to full ink. - Fields are filled, not bordered (input, textarea, select, date field). - Buttons: secondary is a fill only; primary and danger get a highlight edge instead of a border. Menus highlight with the wash. - Card: no drop shadow, a 16px medium title. Borders one step lighter. `bun run gallery` renders the kit's real views in Chromium and screenshots them in light and dark, for before and after comparisons. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The production GitHub environment has no secrets, so every auto-deploy after CI on main failed planning the stack (S3_BUCKET: Expected string). Prod secrets live in Infisical; the deploy job now signs in with its GitHub OIDC token (identity bound to this repo's production environment) and exports Infisical's prod env, the same source alchemy:deploy:prd:local uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…s bound to Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Maple review🟢 Confidence 9/10 · safe to merge. No defects found; the open risk is whether Infisical The prod deploy now takes every secret from Infisical over GitHub OIDC instead of the empty
Before merge
|
|
Merged with 3 steps from "Before merge" still open. If they are done, tick them on the review comment; if not, now is the time.
|
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every
Deploy PRDrun after CI on main failed in ~40s withSchemaError(Expected string at ["S3_BUCKET"]): the GitHubproductionenvironment has no secrets or vars, and prod secrets only live in Infisical (which is why onlyalchemy:deploy:prd:localhas worked).id-token: writeand a first step,Infisical/secrets-actionwithmethod: oidc, that exports Infisical'sprodenv.env:entries in the YAML shadow what the action writes toGITHUB_ENV, so they would have stayed empty.Setup (done): Infisical identity
hazel-gh-productionwith OIDC auth bound torepo:MapleTechLabs/hazel:environment:production(audiencehttps://github.com/MapleTechLabs),vieweron the Hazel project (custom prod-only roles need Enterprise); its ID is theINFISICAL_IDENTITY_IDvariable on theproductionenvironment.PR previews have the same empty-env problem in
pr-preview; not changed here.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.