feat(#705): manage actions secrets in the pulumi program by zgeoff · Pull Request #721 · zgeoff/vers

zgeoff · 2026-07-20T13:12:53Z

Description

Closes #705

Declares the repo's Actions secrets in infra/github.ts, with values resolved from the vers-ci 1Password vault via op run at deploy time. The vault is backfilled: freshly minted Fly org and Bugsink API tokens, the prod DATABASE_URL, and the CI Discord webhook and DOTENV_* items moved from vers into vers-ci.

OP_SERVICE_ACCOUNT_TOKEN stays console-managed — it is the credential the resolution itself authenticates with.
NX_CLOUD_ACCESS_TOKEN was dead and is deleted from the repo, not adopted.
The DOTENV_* vault items drop their title suffixes — op:// references reject parentheses.
The infra-drift job now resolves the secret values, so DATABASE_URL and the deploy tokens are readable from vers-ci; the deployment doc's vault-scoping passage is updated to match.

Testing

bun run typecheck passes
bun run test passes
bun run lint passes
New tests added for new functionality

Context

pulumi preview --stack prod shows exactly the 6 secret creates, 30 unchanged. The infra-drift PR check will red on this PR until pulumi up adopts the secrets — planned right before merge, followed by revoking the superseded github-ci-deploy Fly token.

coderabbitai · 2026-07-20T13:13:33Z

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 861036b1-7ea8-4f3f-bcaf-4ecb9314a3ec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

The change moves additional GitHub Actions secrets and two app environment documents to the vers-ci 1Password vault, resolves them through Pulumi, exposes their secret names, and updates the infra-drift workflow plus operational documentation.

Changes

Actions secret vault wiring

Layer / File(s)	Summary
Env manifest vault support `scripts/src/env/*`, `AGENTS.md`, `agents/project.md`	Env manifests accept `vers-ci` entries, and the DOTENV app files now resolve from that vault via the `op` CLI.
Pulumi Actions secret declarations `infra/.env.example`, `infra/github.ts`, `infra/index.ts`, `infra/README.md`	Required environment values are validated, wrapped as Pulumi secrets, and assigned to repository or production GitHub Actions secrets with exported names.
Workflow and operational documentation `.github/workflows/infra-drift.yml`, `docs/architecture/platform/*`, `apps/bugsink/README.md`	Infra drift loads the added runtime credentials, and deployment, database, and Bugsink instructions document the updated `vers-ci` sourcing paths.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

zgeoff/vers#659: Introduced the Pulumi infra-drift workflow that this change extends.
zgeoff/vers#663: Updated infra-drift and vault credential wiring for the vers-ci vault.
zgeoff/vers#704: Established related GitHub Actions configuration in infra/github.ts.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR covers the new secret resources and op:// wiring, but it omits the linked NX_CLOUD_ACCESS_TOKEN backfill.	Add or re-mint NX_CLOUD_ACCESS_TOKEN in 1Password and wire it into infra/github.ts, or update the issue scope if it is no longer needed.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and matches the main change: managing Actions secrets in the Pulumi program.
Description check	✅ Passed	The description clearly describes the secret-management and vault-backfill changes in this PR.
Out of Scope Changes check	✅ Passed	The changes stay focused on Actions secret management, env manifests, and related docs, with no obvious unrelated additions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 705-actions-secrets

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-20T13:28:14Z

🍹 `preview` on vers-infra/prod

Pulumi report

   Previewing update (prod):
Downloading plugin terraform-provider-1.2.0: starting
Downloading plugin cloudflare-6.17.0: starting
Downloading plugin github-6.14.0: starting
Downloading plugin github-6.14.0: done
Installing plugin github-6.14.0: starting
Downloading plugin terraform-provider-1.2.0: done
Installing plugin terraform-provider-1.2.0: starting
Downloading plugin cloudflare-6.17.0: done
Installing plugin cloudflare-6.17.0: starting
Installing plugin github-6.14.0: done
@ previewing update....
Installing plugin terraform-provider-1.2.0: done
Installing plugin cloudflare-6.17.0: done

@ previewing update.....
~  pulumi:pulumi:Stack vers-infra-prod refreshing 
~  pulumi:providers:axiom axiom refreshing 
~  pulumi:pulumi:Stack vers-infra-prod refreshing 
~  github:index:ActionsVariable vite-umami-website-id refreshing 
~  pulumi:providers:axiom axiom refresh 
~  github:index:RepositoryEnvironment production refreshing 
~  cloudflare:index:DnsRecord resend-return-path-mx refreshing 
~  axiom:index:Token vers-mcp refreshing 
~  axiom:index:Dataset vers-metrics refreshing 
~  axiom:index:Dataset vers-traces refreshing 
~  axiom:index:Token vers-production refreshing 
~  axiom:index:Dataset vers-logs refreshing 
~  axiom:index:Notifier vers-alarms refreshing 
~  axiom:index:Dashboard vers-services-baseline refreshing 
~  cloudflare:index:DnsRecord apex refreshing 
~  cloudflare:index:DnsRecord resend-dkim refreshing 
~  cloudflare:index:DnsRecord resend-dmarc refreshing 
~  github:index:RepositoryRuleset main-protection refreshing 
~  cloudflare:index:DnsRecord resend-return-path-spf refreshing 
~  cloudflare:index:DnsRecord www refreshing 
~  github:index:ActionsVariable vite-umami-website-id refresh 
~  axiom:index:Dataset vers-logs refresh 
~  github:index:IssueLabels vers refreshing 
~  axiom:index:Monitor vers-5xx-responses refreshing 
~  axiom:index:Dataset vers-metrics refresh 
~  axiom:index:Monitor vers-replay-poke-failed refreshing 
~  axiom:index:Dataset vers-traces refresh 
~  github:index:ActionsEnvironmentVariable service-auth-public-key refreshing 
~  axiom:index:Notifier vers-alarms refresh 
~  github:index:ActionsEnvironmentVariable vite-sentry-dsn refreshing 
~  axiom:index:Monitor vers-5xx-responses refresh 
~  axiom:index:Monitor vers-replay-poke-failed refresh 
~  neon:index:Branch main refreshing 
~  neon:index:Project vers refreshing 
~  cloudflare:index:DnsRecord apex refresh 
~  neon:index:Role mcp-ro refreshing 
~  cloudflare:index:DnsRecord resend-dkim refresh 
~  neon:index:Endpoint main refreshing 
~  cloudflare:index:DnsRecord resend-return-path-mx refresh 
~  neon:index:Branch dev refreshing 
~  cloudflare:index:DnsRecord resend-dmarc refresh 
~  neon:index:Endpoint dev refreshing 
~  axiom:index:Dashboard vers-services-baseline refresh 
~  neon:index:Role mcp-dev refreshing 
~  github:index:RepositoryEnvironment production refresh 
~  github:index:ActionsSecret dotenv-app-web-e2e refreshing 
~  cloudflare:index:DnsRecord resend-return-path-spf refresh 
~  github:index:ActionsSecret dotenv-app-web-dev refreshing 
@ previewing update....
~  axiom:index:Token vers-mcp refresh 
~  github:index:ActionsEnvironmentSecret database-url refreshing 
~  axiom:index:Token vers-production refresh 
~  github:index:ActionsEnvironmentSecret discord-webhook-url refreshing 
~  github:index:RepositoryRuleset main-protection refresh 
~  github:index:ActionsEnvironmentSecret fly-api-token refreshing 
~  neon:index:Endpoint main refresh 
~  github:index:ActionsEnvironmentSecret sentry-auth-token refreshing 
~  neon:index:Branch main refresh 
~  neon:index:Branch dev refresh 
~  cloudflare:index:DnsRecord www refresh 
~  github:index:ActionsEnvironmentVariable service-auth-public-key refresh 
~  neon:index:Endpoint dev refresh 
~  neon:index:Role mcp-ro refresh 
~  github:index:ActionsEnvironmentVariable vite-sentry-dsn refresh 
~  neon:index:Role mcp-dev refresh 
~  github:index:IssueLabels vers refresh 
~  github:index:ActionsSecret dotenv-app-web-e2e refresh 
~  github:index:ActionsSecret dotenv-app-web-dev refresh 
@ previewing update....
~  github:index:ActionsEnvironmentSecret database-url refresh 
~  neon:index:Project vers refresh 
~  github:index:ActionsEnvironmentSecret discord-webhook-url refresh 
~  github:index:ActionsEnvironmentSecret fly-api-token refresh 
~  github:index:ActionsEnvironmentSecret sentry-auth-token refresh 
   pulumi:pulumi:Stack vers-infra-prod running 
@ previewing update.....
   pulumi:providers:axiom axiom  
   github:index:RepositoryRuleset main-protection  
   github:index:ActionsSecret dotenv-app-web-e2e  
   github:index:RepositoryEnvironment production  
   axiom:index:Dashboard vers-services-baseline  
   axiom:index:Token vers-production  
   axiom:index:Dataset vers-metrics  
   axiom:index:Dataset vers-traces  
   axiom:index:Token vers-mcp  
   axiom:index:Dataset vers-logs  
   axiom:index:Notifier vers-alarms  
   cloudflare:index:DnsRecord resend-dmarc  
   cloudflare:index:DnsRecord resend-dkim  
   cloudflare:index:DnsRecord apex  
   github:index:ActionsSecret dotenv-app-web-dev  
   cloudflare:index:DnsRecord resend-return-path-spf  
   cloudflare:index:DnsRecord www  
   cloudflare:index:DnsRecord resend-return-path-mx  
   github:index:ActionsVariable vite-umami-website-id  
   github:index:IssueLabels vers  
@ previewing update....
   axiom:index:Monitor vers-replay-poke-failed  
   axiom:index:Monitor vers-5xx-responses  
   github:index:ActionsEnvironmentVariable vite-sentry-dsn  
   neon:index:Project vers  
   github:index:ActionsEnvironmentSecret sentry-auth-token  
   github:index:ActionsEnvironmentSecret discord-webhook-url  
   github:index:ActionsEnvironmentSecret fly-api-token  
   github:index:ActionsEnvironmentVariable service-auth-public-key  
   github:index:ActionsEnvironmentSecret database-url  
   neon:index:Branch main  
   neon:index:Role mcp-ro  
   neon:index:Endpoint main  
   neon:index:Branch dev  
   neon:index:Role mcp-dev  
   neon:index:Endpoint dev  
   pulumi:pulumi:Stack vers-infra-prod  
Resources:
   36 unchanged

feat(#705): manage actions secrets in the pulumi program

0babc2a

docs: rewrap the env-files paragraph in the project partial

9fcbd27

zgeoff merged commit 2e662e4 into main Jul 20, 2026
8 of 9 checks passed

zgeoff deleted the 705-actions-secrets branch July 20, 2026 13:48

Navigation Menu

feat(#705): manage actions secrets in the pulumi program - #721

feat(#705): manage actions secrets in the pulumi program#721
zgeoff merged 2 commits into
mainfrom
705-actions-secrets

zgeoff commented Jul 20, 2026

Uh oh!

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

❌ Failed checks (2 warnings)

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

zgeoff commented Jul 20, 2026

Description

Testing

Context

Uh oh!

coderabbitai Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

❌ Failed checks (2 warnings)

Uh oh!

github-actions Bot commented Jul 20, 2026

🍹 preview on vers-infra/prod

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 20, 2026 •

edited

Loading

🍹 `preview` on vers-infra/prod