fix(aros-web): reproducible build with Supabase baked in (+ fail-loud guard)#10
Merged
Conversation
The web build inlines VITE_SUPABASE_URL/ANON_KEY at build time. CI builds
without them (no .env in context, no build-args), producing a bundle that
calls createClient("","") -> throws "supabaseUrl is required" at module
load -> React never mounts -> blank white page (the app.aros.live login
outage).
- loadEnv with empty prefix so the unprefixed SUPABASE_*/ANON_KEY the
servers already provide are picked up (Vite only auto-exposes VITE_*).
- define{} inlines ONLY the two public keys (never SUPABASE_SERVICE_ROLE_KEY).
- Fail the build if either is empty, so a misconfigured build errors loudly
instead of silently shipping a blank app.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a self-contained, parameterized build for ghcr.io/shreai/shreai/aros so the customer web app can't ship a blank-page bundle again: - deploy/web-server.mjs: the tiny static server (SPA fallback to index.html) that the runtime image uses, now version-controlled (was only inside the published image). - deploy/Dockerfile.web: packages a prebuilt apps/web/dist into the node:20 runtime; fails the build if the dist has no Supabase URL baked in. - deploy/build-aros-web.sh: builds apps/web/dist on the host with VITE_SUPABASE_*/SUPABASE_* exported (Vite inlines at build time), verifies the URL is present, then packages + optionally pushes the image. Host-build-then-package is required because the workspace has an absolute link:/shre-sdk dependency that a hermetic in-container install can't resolve. Verified: produces an image whose bundle has the Supabase URL, serves /auth via SPA fallback, /health ok, and does NOT leak the service-role key. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Nirpat3
changed the title
deploy/deploy-aros-web.sh builds the image from source (Supabase baked in) and recreates the aros container in place — no GitHub Actions, no GHCR push. Keeps the prior container as a timestamped rollback backup and verifies /health. Lets aros be shipped entirely from the host while cloud CI is off. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
app.aros.livelogin showed a blank white page: the servedapps/webbundle calledcreateClient("","")becauseVITE_SUPABASE_URL/VITE_SUPABASE_ANON_KEYwere empty at build time, so the Supabase client threwsupabaseUrl is requiredat module load and React never mounted.Root cause: Vite inlines
VITE_*env at build time, but the image build had no.envin context and passed no build-args, so empty strings got baked in.What
apps/web/vite.config.ts:loadEnv(mode, envDir, '')so the unprefixedSUPABASE_URL/SUPABASE_ANON_KEYthe servers already provide are also picked up (Vite only auto-exposesVITE_*).define{}inlines only the two public keys — neverSUPABASE_SERVICE_ROLE_KEY(verified it does not leak into the bundle).Verified locally: guard fires on empty env; unprefixed vars inline correctly; service-role key absent from bundle.
Still needed (infra, not in this PR)
The image-build pipeline (
deploy-aros-prod.yml→ghcr.io/shreai/shreai/aros) must makeSUPABASE_URL+SUPABASE_ANON_KEYavailable at build time (build-args or.envin context). With this guard, that build will now fail loudly until it does, instead of shipping a blank app.🤖 Generated with Claude Code