Salvage: cloudbuild safety + tsx devDependency (May 10 local commits) - #51
Merged
Conversation
- cloudbuild.yaml deploy step now uses --update-env-vars / --update-secrets instead of --set-env-vars. The previous version would have wiped the 6 production secret bindings (DATABASE_URL, NEXTAUTH_SECRET, GOOGLE/APPLE OAuth, RESEND, CRON) and replaced them with literal "your-secret-here" placeholders on every deploy — potential data/auth outage on any trigger. - Tag images by $BUILD_ID (immutable, unique per build) plus :latest, so rollback is one gcloud run deploy --image=...:$BUILD_ID away. - Mirror current Cloud Run config: cpu=1, memory=512Mi, max-instances=20. - Push happens via images: block (no separate push step). - Add .dockerignore to keep local node_modules / .next / .env / secrets out of the build context — avoids macOS native binaries clobbering the Linux ones produced by the deps stage. - Add .gcloudignore so gcloud builds submit uploads ~3 MiB instead of 1 GB. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
oratis
force-pushed
the
chore/salvage-cloudbuild-tsx
branch
from
August 8, 2026 09:02
d73fc4f to
ff60f87
Compare
Owner
Author
|
本 PR 是 5 月 10 日两个未推送本地提交的打捞:cloudbuild 从 --set-env-vars(每次触发会抹掉 6 个生产 secret 绑定)改为 --update-env-vars/--update-secrets,加 BUILD_ID 不可变镜像标签便于回滚,新增 .dockerignore/.gcloudignore 防止 .env 和本地 db 进入构建上下文,tsx 落为 devDependency。内容自洽、注释充分,是明确有价值的完成态部署安全修复。决定 merge(squash)。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Local-worktree sweep 2026-08-08: two complete local commits from May 10 that never got pushed (the remote main has since moved on) — cherry-picked onto current main.
🤖 Generated with Claude Code