fix(cli): resolve stack environment overrides and encrypted secrets - #6535
Open
jgoux wants to merge 3 commits into
Open
fix(cli): resolve stack environment overrides and encrypted secrets#6535jgoux wants to merge 3 commits into
jgoux wants to merge 3 commits into
Conversation
Contributor
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@5f19cbb84753bd87790acd9851ee6d3c2686d2a2Preview package for commit |
pull Bot
pushed a commit
to oogalieboogalie/cli
that referenced
this pull request
Sep 9, 2026
…base#6538) ## What kind of change does this PR introduce? CI reliability fix. ## What is the current behavior? AI Review's Codex jobs (`codex-review`, `adjudicate`) intermittently hang and get killed on job timeout, discarding a completed review. Most recently: [run 34323125644](https://github.com/supabase/cli/actions/runs/34323125644) on supabase#6535 died at ~55 minutes against a 45-minute timeout. This is a regression. supabase#6380 deliberately pinned `openai/codex-action` to v1.11 because v1.12 had a confirmed hang bug (openai/codex-action#150). supabase#6484 — a Dependabot `actions-major` group bump bundling 6 unrelated action updates — silently reverted that pin back to v1.12; the workflow's own comments (still saying "pinned to v1.11, NOT v1.12") went stale rather than catching the drift, since nothing diffed them against the actual `uses:` line. Checking upstream today turned up two separate, still-open v1.12 regressions, both matching this workflow's exact config (`safety-strategy: drop-sudo`, `sandbox: read-only`, `output-schema-file`): - openai/codex-action#151 — the v1.12 wrapper waits on the child process's `close` event with inherited stdio; a lingering descendant keeps the step alive forever after Codex has already written its output and finished. - openai/codex-action#160 — v1.12's `drop-sudo` rewrite chmods root-owned `/run` service sockets, breaking `systemd-resolved` on the GitHub-hosted runner itself, which kills the job 52-65 minutes in regardless of the job's own timeout — matching our job's 55-minute death exactly. Neither has a released fix. Both are action-level bugs independent of the pinned Codex CLI version (reproduced across CLI versions 0.147.0-0.150.1 in the upstream threads). This is not a diff-size or token-limit problem: supabase#6535's diff was only ~2200 lines, and v1.11 has cleanly handled 130k-270k-token diffs in under 15 minutes per the upstream reports and our own prior testing. ## What is the new behavior? - Re-pin `openai/codex-action` to v1.11 (`52fe01ec70a42f454c9d2ebd47598f9fd6893d56`) in both Codex jobs — verified it's a safe drop-in, since v1.11's `action.yml` supports every input this workflow uses. - Refresh the stale inline comments to cite the actual issues (#151, #160) instead of just the original #150. - Add `openai/codex-action` to `.github/dependabot.yml`'s `ignore` list (no `update-types` restriction, so it blocks all automated bumps) so a grouped bump can't silently regress this pin again. Any future bump now requires a deliberate PR that checks the upstream changelog/issue tracker first.
Member
|
/ai-review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 AI Review
All 12 reported findings were verified and deduplicated into 10 confirmed findings. The main defects are broken Vonage secret projection, invalid SMTP port projection, missing semantic validation after auth environment overrides, and several advertised automatic overrides being ignored. No findings were refuted or left uncertain.
Findings
| Severity | Location | Category | Sources | Claim |
|---|---|---|---|---|
| 🟠 MAJOR | apps/cli/src/commands/experimental/stack/stack-config.ts:557 |
secret-handling |
claude+codex | Vonage API keys are projected as plain strings, so configured keys fail the Redacted stack schema and encrypted keys bypass the decryption walker. |
| 🟠 MAJOR | apps/cli/src/commands/experimental/stack/stack-config.ts:577 |
correctness |
claude | A present [auth.email.smtp] table without a port is projected with port 0 and consequently fails stack schema decoding. |
| 🟠 MAJOR | apps/cli/src/commands/experimental/stack/stack-config.ts:607 |
correctness |
claude+codex | The advertised automatic override layer ignores established overrides for signing keys, storage image transformation, database health timeout, and API automatic table exposure. |
| 🟠 MAJOR | apps/cli/src/commands/experimental/stack/stack-config.ts:518 |
validation |
codex | Auth environment overrides can enable incomplete providers, SMS services, captcha, hooks, and third-party integrations without rerunning their required-field semantic validation. |
| 🟡 MINOR | apps/cli/src/commands/experimental/stack/stack-config.ts:912 |
error-handling |
claude | SUPABASE_ANALYTICS_BACKEND bypasses the established enum validator, so malformed values fail later as a generic stack-schema error instead of the typed analytics configuration error. |
| 🟡 MINOR | apps/cli/src/commands/experimental/stack/stack-config.ts:515 |
correctness |
codex | The stack's raw-document presence filter discards the resolver's intentional env-only Apple provider result. |
| ⚪ NIT | apps/cli/src/commands/experimental/stack/stack-config.ts:1143 |
code-quality |
claude | jwtSigning() is evaluated twice to construct one optional field. |
| ⚪ NIT | apps/cli/src/commands/experimental/stack/stack-config.ts:1283 |
code-quality |
claude | The call-site Effect.mapError around readFunctionEnvironments is redundant. |
| ⚪ NIT | apps/cli/src/commands/experimental/stack/stack-config.ts:1364 |
effect-idiom |
claude | The new ambient process.env read bypasses Effect host-service dependency tracking in the Effect-linted experimental stack code. |
| ⚪ NIT | apps/cli/src/commands/experimental/stack/stack-config.ts:800 |
code-quality |
claude | normalizeDbSessionReplicationRole redundantly revalidates an already narrowed resolver result and would silently erase an impossible invalid value. |
Stats
Claude findings: 8 · Codex findings: 4 · Confirmed: 10 · Refuted: 0 · Uncertain: 0
Models: claude-opus-5 + gpt-5.6-sol · Trigger: manual · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restore existing configuration behavior in
supabase experimental stack start: apply supported automaticSUPABASE_*overrides using the shared configuration resolvers, and decrypt dotenvxencrypted:secrets before passing them to the stack.Overrides retain shell and project dotenv precedence, optional-section semantics, and dynamic listener allocation when no port is explicitly supplied. Effective auth settings are validated after overrides and decryption. Decryption supports base, suffixed, and comma-separated private keys and reports configuration errors without exposing secret values.
Follow-up to #6506, implementing the requests in encrypted-secret handling and automatic environment overrides. Update command help and side-effect documentation to describe the restored behavior.