Remove default env variables #1511
Conversation
WalkthroughClears four VITE_* URL environment variables in apps/cyberstorm-remix/.env; all other variables remain unchanged. No code changes. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
apps/cyberstorm-remix/.env (3)
7-10: Avoid shadowing real config: empty strings are “defined but empty” in ViteLeaving these keys with empty values makes them truthy-check false, but still “defined,” which can bypass fallback logic and unexpectedly override values coming from CI or .env.[mode]/.env.local. Prefer commenting them out (or removing) so they are truly unset at load time.
Apply this minimal, intent-revealing change:
-VITE_SITE_URL= -VITE_API_URL= -VITE_AUTH_BASE_URL= -VITE_AUTH_RETURN_URL= +# Intentionally unset. Define these in .env.local or CI secrets: +# VITE_API_URL= +# VITE_AUTH_BASE_URL= +# VITE_AUTH_RETURN_URL= +# VITE_SITE_URL=Follow-ups:
- Ensure code that consumes these vars either validates presence at boot or has explicit fallbacks (e.g., window.location.origin for site URL, relative API paths, etc.).
- Consider moving these commented placeholders to a tracked apps/cyberstorm-remix/.env.example and keep .env unopinionated.
7-10: Optional: satisfy dotenv-linter ordering if you keep the keys uncommentedIf you decide to keep these keys present (not commented), re-order alphabetically to quiet dotenv-linter.
- VITE_SITE_URL= - VITE_API_URL= - VITE_AUTH_BASE_URL= - VITE_AUTH_RETURN_URL= + VITE_API_URL= + VITE_AUTH_BASE_URL= + VITE_AUTH_RETURN_URL= + VITE_SITE_URL=
7-10: Offer: add a build-time/env validation guardTo prevent silent misconfig, add a tiny env validation module (e.g., zod) that asserts required VITE_* vars are non-empty in production builds and throws with a clear message otherwise. I can open a follow-up PR with a minimal helper and tests if you want.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
apps/cyberstorm-remix/.env(1 hunks)
🧰 Additional context used
🪛 dotenv-linter (3.3.0)
apps/cyberstorm-remix/.env
[warning] 8-8: [UnorderedKey] The VITE_API_URL key should go before the VITE_SITE_URL key
(UnorderedKey)
[warning] 9-9: [UnorderedKey] The VITE_AUTH_BASE_URL key should go before the VITE_SITE_URL key
(UnorderedKey)
[warning] 10-10: [UnorderedKey] The VITE_AUTH_RETURN_URL key should go before the VITE_SITE_URL key
(UnorderedKey)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Generate visual diffs
- GitHub Check: Test
- GitHub Check: CodeQL
| VITE_SITE_URL= | ||
| VITE_API_URL= | ||
| VITE_AUTH_BASE_URL= | ||
| VITE_AUTH_RETURN_URL= |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Double-check env precedence in your pipelines before merging
Depending on how Vite/dotenv are invoked in your build, a blank value in .env can still take precedence over system envs or vice versa. Verify what your CI/CD actually injects and whether there are any .env.[mode]* files that should win.
Run this repo-safe script to audit usages and potential fallbacks:
If this shows no fallbacks and no CI provisioning, consider adding a small runtime/build-time env schema check to fail fast.
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) List env files for this app (to infer precedence):"
fd -H -a '^\.env(\..+)?(\.local)?$' apps/cyberstorm-remix || true
echo -e "\n2) Find references to the removed defaults (TS/JS/TSX/JSX):"
rg -nP --glob 'apps/cyberstorm-remix/**' --type-add 'web:*.{ts,tsx,js,jsx}' \
-tweb -C2 'import\.meta\.env\.(VITE_SITE_URL|VITE_API_URL|VITE_AUTH_BASE_URL|VITE_AUTH_RETURN_URL)'
echo -e "\n3) Heuristic: look for explicit fallbacks (?? or ||) near those vars:"
rg -nP --glob 'apps/cyberstorm-remix/**' -C1 '(VITE_SITE_URL|VITE_API_URL|VITE_AUTH_BASE_URL|VITE_AUTH_RETURN_URL).*(\?\?|\|\|)'
echo -e "\n4) Check workflows for these vars being supplied by CI:"
rg -n --glob '.github/workflows/**' 'VITE_(SITE_URL|API_URL|AUTH_BASE_URL|AUTH_RETURN_URL)' -n -C2 || trueLength of output: 12621
Ensure CI injects all VITE_ variables and add fallbacks or schema checks
- We only have a single
.envatapps/cyberstorm-remix/.env—no.env.localor mode-specific files are present. Blank entries there will be applied by Vite and could override any system-level variables in your build environment. - Nearly every usage of
import.meta.env.VITE_API_URL,VITE_AUTH_BASE_URL, andVITE_AUTH_RETURN_URLlacks a fallback; onlyVITE_SITE_URLis guarded via?? "https://thunderstore.io"inapp/root.tsx(lines 111 & 200). - We didn’t detect these variables being set in any
.github/workflowsfiles—confirm your CI/CD pipelines actually supplyVITE_API_URL,VITE_AUTH_BASE_URL, andVITE_AUTH_RETURN_URL. - To prevent silent misconfiguration, either remove the blank declarations from
.envso pipeline-provided values take effect, or introduce a dedicated env schema validation (e.g. with Zod or a custom check) that errors out at build or startup when anyVITE_*var is missing or empty.
🧰 Tools
🪛 dotenv-linter (3.3.0)
[warning] 8-8: [UnorderedKey] The VITE_API_URL key should go before the VITE_SITE_URL key
(UnorderedKey)
[warning] 9-9: [UnorderedKey] The VITE_AUTH_BASE_URL key should go before the VITE_SITE_URL key
(UnorderedKey)
[warning] 10-10: [UnorderedKey] The VITE_AUTH_RETURN_URL key should go before the VITE_SITE_URL key
(UnorderedKey)
🤖 Prompt for AI Agents
In apps/cyberstorm-remix/.env around lines 7-10 the VITE_ variables are declared
blank which will override system/CI-provided envs and lead to missing values at
build/runtime; remove these empty entries so CI-injected vars take effect, or
replace them with explicit defaults only when appropriate, and add an env
validation step (Zod or a simple runtime/build check) that throws a clear error
when VITE_API_URL, VITE_AUTH_BASE_URL, or VITE_AUTH_RETURN_URL are
missing/empty; also update code sites that use import.meta.env.VITE_* to use
safe fallbacks (e.g., ?? throw-or-default) or rely on the validation to
guarantee presence, and confirm your GitHub Actions/CI workflow sets these
secrets/envs.
Summary by CodeRabbit