Skip to content
Open
Show file tree
Hide file tree
Changes from 8 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions .env.example
Original file line number Diff line number Diff line change
@@ -1,9 +1,15 @@
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=
CRON_SECRET=
APP_MASTER_KEY_B64=
OPENAI_API_KEY=
OPENAI_MODEL=gpt-4o-mini
BETTER_AUTH_SECRET=
BETTER_AUTH_URL=
STORAGE_SIGNING_SECRET=
PHOTO_BUCKET=photos
EXPORT_BUCKET=exports

# Supabase migration and temporary first-login bridge only.
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=
LEGACY_SUPABASE_URL=
LEGACY_SUPABASE_ANON_KEY=
Comment on lines 1 to +15

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Restore the dotenv-linter key order.

The supplied dotenv-linter report flags the new keys as unordered. Sort the keys to keep the environment-template lint check clean.

🧰 Tools
🪛 dotenv-linter (4.0.0)

[warning] 4-4: [UnorderedKey] The BETTER_AUTH_SECRET key should go before the OPENAI_API_KEY key

(UnorderedKey)


[warning] 5-5: [UnorderedKey] The BETTER_AUTH_URL key should go before the OPENAI_API_KEY key

(UnorderedKey)


[warning] 7-7: [UnorderedKey] The PHOTO_BUCKET key should go before the STORAGE_SIGNING_SECRET key

(UnorderedKey)


[warning] 8-8: [UnorderedKey] The EXPORT_BUCKET key should go before the OPENAI_API_KEY key

(UnorderedKey)


[warning] 12-12: [UnorderedKey] The NEXT_PUBLIC_SUPABASE_ANON_KEY key should go before the NEXT_PUBLIC_SUPABASE_URL key

(UnorderedKey)


[warning] 14-14: [UnorderedKey] The LEGACY_SUPABASE_URL key should go before the NEXT_PUBLIC_SUPABASE_ANON_KEY key

(UnorderedKey)


[warning] 15-15: [UnorderedKey] The LEGACY_SUPABASE_ANON_KEY key should go before the LEGACY_SUPABASE_URL key

(UnorderedKey)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.env.example around lines 1 - 15, Reorder the environment variables in the
dotenv template according to dotenv-linter’s expected key order, including the
newly added Supabase-related keys, while preserving every key and its current
value or empty placeholder.

Source: Linters/SAST tools

54 changes: 54 additions & 0 deletions .github/workflows/deploy-cloudflare-dev.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
name: Deploy Cloudflare dev

on:
push:
branches:
- dev
workflow_dispatch:

permissions:
contents: read

concurrency:
group: photo-texte-cloudflare-dev
cancel-in-progress: true

jobs:
deploy:
runs-on: ubuntu-latest
timeout-minutes: 20
env:
CLOUDFLARE_ACCOUNT_ID: 2ea670c2a6ff28e248ef084adf095e8b
DEV_URL: https://photo-texte-dev.mani1261790.workers.dev
steps:
- name: Check out repository
uses: actions/checkout@v4
with:
persist-credentials: false

- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: 22
cache: npm

- name: Install dependencies
run: npm ci

- name: Run tests
run: npm test -- --run

- name: Check types
run: npx tsc --noEmit

- name: Deploy dev Worker
run: npm run cf:deploy:dev
Comment on lines +44 to +45

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json
scripts = json.load(open("package.json"))["scripts"]
for name in ("cf:deploy:dev", "db:migrate:dev", "db:migrate:shared"):
    print(f"{name}: {scripts.get(name, '<missing>')}")
PY

rg -n -C 3 '"d1_databases"|"migrations_dir"|"dev"' wrangler.jsonc

Repository: mani1261790/PHOTO-TEXTE

Length of output: 1148


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- workflow excerpt ---\n'
sed -n '1,90p' .github/workflows/deploy-cloudflare-dev.yml

printf '\n--- package scripts excerpt ---\n'
python3 - <<'PY'
import json
with open("package.json") as f:
    scripts = json.load(f)["scripts"]
for name in sorted(scripts):
    if "dev" in name.lower() or "cf:" in name or "db" in name.lower() or "migrate" in name.lower():
        print(f"{name}: {scripts[name]}")
PY

printf '\n--- cloudflare/migrations directory ---\n'
if [ -d cloudflare/migrations ]; then
  find cloudflare/migrations -maxdepth 2 -type f -print | sort
else
  echo '<missing>'
fi

printf '\n--- deploy scripts references ---\n'
rg -n "cf:deploy:dev|opennextjs-cloudflare|wrangler.*d1|migrations apply|DB --remote|env.dev|env=\"\"" .

Repository: mani1261790/PHOTO-TEXTE

Length of output: 252


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- workflow excerpt ---'
sed -n '1,90p' .github/workflows/deploy-cloudflare-dev.yml

printf '%s\n' ''
printf '%s\n' '--- package scripts excerpt ---'
python3 - <<'PY'
import json
with open("package.json") as f:
    scripts = json.load(f)["scripts"]
for name in sorted(scripts):
    if "dev" in name.lower() or "cf:" in name or "db" in name.lower() or "migrate" in name.lower():
        print(f"{name}: {scripts[name]}")
PY

printf '%s\n' ''
printf '%s\n' '--- cloudflare/migrations directory ---'
if [ -d cloudflare/migrations ]; then
  find cloudflare/migrations -maxdepth 2 -type f -print | sort
else
  echo '<missing>'
fi

printf '%s\n' ''
printf '%s\n' '--- deploy scripts references ---'
rg -n "cf:deploy:dev|opennextjs-cloudflare|wrangler.*d1|migrations apply|DB --remote|env.dev|env=\"\"" .

Repository: mani1261790/PHOTO-TEXTE

Length of output: 3352


Run D1 migrations before cf:deploy:dev.

npm run cf:deploy:dev only builds and deploys the dev Worker, and there is no separate cf:migrate:dev script. Run the shared dev D1 migration command before deployment so new Worker code does not execute against an older photo-texte schema. Use the dev D1 binding from wrangler.jsonc when applying migrations.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-cloudflare-dev.yml around lines 43 - 44, Update the
“Deploy dev Worker” workflow step to run the shared D1 migration command before
npm run cf:deploy:dev, targeting the dev D1 binding named photo-texte from
wrangler.jsonc. Preserve the existing deployment command and ordering so
migrations complete before the Worker is deployed.

env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

- name: Verify dev deployment
run: |
login_status=$(curl --silent --show-error --connect-timeout 10 --max-time 30 --output /dev/null --write-out '%{http_code}' "$DEV_URL/login")
auth_status=$(curl --silent --show-error --connect-timeout 10 --max-time 30 --output /dev/null --write-out '%{http_code}' "$DEV_URL/api/me")
test "$login_status" = "200"
test "$auth_status" = "403"
3 changes: 3 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
.next
.open-next
.wrangler
worker-configuration.d.ts
node_modules
.env
.env.local
Expand Down
Loading
Loading