test(docker): guard entrypoint build fingerprint against vite envPrefix drift - #213
Open
WAHIB-EL-KHADIRI wants to merge 1 commit into
Open
Conversation
docker-entrypoint.sh skips the client build when build-relevant envs are unchanged, fingerprinting them via a grep allow-list that must stay in sync with vite.config.ts's envPrefix (plus POSTHOG_SOURCEMAPS). The "keep in sync" coupling was comment-only; this adds a fast unit test that fails loudly if the two lists drift, preventing a silently stale build reuse after an env change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
Hey, Thanks for contributing! For the next few months, I'm going to stop accepting external PRs. Reviewing and testing them has been slowing down progress against our roadmap: Contributing through Issues Here is our updated contributing guide: https://github.com/every-app/open-seo/blob/main/docs/CONTRIBUTING.md Converting, this PR to an issue would be the best way to get it prioritized. You can use the the |
oluwaseunmauwedo
pushed a commit
to oluwaseunmauwedo/open-seo
that referenced
this pull request
Aug 25, 2026
ramonmnavarro-byte
pushed a commit
to ramonmnavarro-byte/open-seo
that referenced
this pull request
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a fast unit test (
src/shared/docker-entrypoint-env-sync.test.ts) asserting that the env allow-list used bydocker-entrypoint.shto fingerprint the client build stays in sync withvite.config.ts'senvPrefix— plus the build-only extras (POSTHOG_SOURCEMAPS).Why
docker-entrypoint.shskips the client build when the build-relevant envs are unchanged:FINGERPRINT="$(env | grep -E '^(VITE_|AUTH_MODE|BYPASS_EMAIL_VERIFICATION|POSTHOG_PUBLIC_KEY|POSTHOG_HOST|TURNSTILE_SITE_KEY|POSTHOG_SOURCEMAPS)' | sort | sha256sum ...)"That list must mirror
vite.config.tsenvPrefix(the prefixes Vite inlines into the client bundle). Today the coupling is enforced only by a "keep in sync" comment. If a newenvPrefixentry is added without updating the entrypoint, a self-host container could silently reuse a stale build after a build-relevant env changed. This test makes that drift a loud CI failure instead.Notes
pnpm exec vitest run src/shared/docker-entrypoint-env-sync.test.ts→ 1 passed.🤖 Generated with Claude Code