From d5233bb5cecd5c7a0f19c080d7f239287a0b977a Mon Sep 17 00:00:00 2001 From: SimpleTest Date: Tue, 21 Jul 2026 03:51:43 +0300 Subject: [PATCH] Require Build Week session ID for deployments --- docs/operations.md | 2 ++ scripts/init-production-env.sh | 9 ++++++++- scripts/quality.sh | 31 +++++++++++++++++++++++++++++- scripts/validate-production-env.sh | 9 +++++++++ 4 files changed, 49 insertions(+), 2 deletions(-) diff --git a/docs/operations.md b/docs/operations.md index 1acf8e0..5d2295b 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -83,6 +83,7 @@ Create staging with independent names and secrets: PRODUCTION_COMPOSE_PROJECT_NAME=who_need_help_staging \ PRODUCTION_PUBLIC_UPSTREAM_NAME=who-need-help-staging \ PRODUCTION_HTTP_PORT=4011 \ +PRODUCTION_CODEX_SESSION_ID=YOUR_MAIN_CODEX_SESSION_ID \ ./scripts/init-production-env.sh \ staging.whoneedhelp.com .env.staging ``` @@ -93,6 +94,7 @@ Create production separately: PRODUCTION_COMPOSE_PROJECT_NAME=who_need_help_production \ PRODUCTION_PUBLIC_UPSTREAM_NAME=who-need-help-production \ PRODUCTION_HTTP_PORT=4010 \ +PRODUCTION_CODEX_SESSION_ID=YOUR_MAIN_CODEX_SESSION_ID \ ./scripts/init-production-env.sh \ whoneedhelp.com .env.production ``` diff --git a/scripts/init-production-env.sh b/scripts/init-production-env.sh index d003326..345fdd1 100755 --- a/scripts/init-production-env.sh +++ b/scripts/init-production-env.sh @@ -50,6 +50,12 @@ compose_project_name=${PRODUCTION_COMPOSE_PROJECT_NAME:-who_need_help} public_edge_enabled=${PRODUCTION_PUBLIC_EDGE_ENABLED:-true} public_edge_network=${PRODUCTION_PUBLIC_EDGE_NETWORK:-who_need_help_public_edge} public_upstream_name=${PRODUCTION_PUBLIC_UPSTREAM_NAME:-who-need-help-production} +codex_session_id=${PRODUCTION_CODEX_SESSION_ID:-} + +if [ -z "$codex_session_id" ]; then + echo "PRODUCTION_CODEX_SESSION_ID is required for the Build Week feedback page." >&2 + exit 1 +fi case "$compose_project_name" in *[!a-zA-Z0-9_-]* | '') @@ -136,6 +142,7 @@ SMTP_TLS_VALUE=$smtp_tls \ SMTP_SSL_VALUE=$smtp_ssl \ EMAIL_FROM_ADDRESS_VALUE=$email_from_address \ SUPPORT_INBOX_ADDRESS_VALUE=$support_inbox_address \ +CODEX_SESSION_ID_VALUE=$codex_session_id \ awk ' BEGIN { replacement["DEPLOYMENT_TARGET"] = "compose" @@ -172,7 +179,7 @@ SUPPORT_INBOX_ADDRESS_VALUE=$support_inbox_address \ replacement["SMTP_SSL"] = ENVIRON["SMTP_SSL_VALUE"] replacement["EMAIL_FROM_ADDRESS"] = ENVIRON["EMAIL_FROM_ADDRESS_VALUE"] replacement["SUPPORT_INBOX_ADDRESS"] = ENVIRON["SUPPORT_INBOX_ADDRESS_VALUE"] - replacement["CODEX_SESSION_ID"] = "not-configured" + replacement["CODEX_SESSION_ID"] = ENVIRON["CODEX_SESSION_ID_VALUE"] } { separator = index($0, "=") diff --git a/scripts/quality.sh b/scripts/quality.sh index 821ea60..55d59b5 100755 --- a/scripts/quality.sh +++ b/scripts/quality.sh @@ -101,6 +101,20 @@ if ./scripts/init-edge-env.sh help.test staging.help.test "$edge_env" >/dev/null exit 1 fi production_env="$scan_dir/.env.production" +missing_codex_env="$scan_dir/.env.production.missing-codex" +if PRODUCTION_TRAEFIK_TRUSTED_IPS=172.20.0.1/32 \ + PRODUCTION_SMTP_RELAY=smtp.help.test \ + PRODUCTION_SMTP_PORT=587 \ + PRODUCTION_SMTP_USERNAME=quality-user \ + PRODUCTION_SMTP_PASSWORD=quality-password \ + PRODUCTION_SMTP_AUTH=always \ + PRODUCTION_SMTP_TLS=always \ + PRODUCTION_SMTP_SSL=false \ + PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \ + ./scripts/init-production-env.sh help.test "$missing_codex_env" >/dev/null 2>&1; then + echo "Production environment initializer accepted a missing Codex session ID." >&2 + exit 1 +fi PRODUCTION_TRAEFIK_TRUSTED_IPS=172.20.0.1/32 \ PRODUCTION_SMTP_RELAY=smtp.help.test \ PRODUCTION_SMTP_PORT=587 \ @@ -110,9 +124,21 @@ PRODUCTION_SMTP_AUTH=always \ PRODUCTION_SMTP_TLS=always \ PRODUCTION_SMTP_SSL=false \ PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \ +PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \ ./scripts/init-production-env.sh help.test "$production_env" >/dev/null test "$(stat -c '%a' "$production_env")" = 600 ./scripts/validate-production-env.sh "$production_env" help.test >/dev/null +placeholder_codex_env="$scan_dir/.env.production.placeholder-codex" +cp "$production_env" "$placeholder_codex_env" +chmod 600 "$placeholder_codex_env" +sed -i \ + 's/^CODEX_SESSION_ID=.*/CODEX_SESSION_ID=copy-the-main-local-codex-session-id/' \ + "$placeholder_codex_env" +if ./scripts/validate-production-env.sh \ + "$placeholder_codex_env" help.test >/dev/null 2>&1; then + echo "Production environment validator accepted the template Codex session ID." >&2 + exit 1 +fi external_production_env="$scan_dir/.env.production.external-db" PRODUCTION_DATABASE_MODE=external \ PRODUCTION_DATABASE_URL=ecto://quality:external-password@database.internal/who_need_help \ @@ -124,6 +150,7 @@ PRODUCTION_SMTP_AUTH=always \ PRODUCTION_SMTP_TLS=always \ PRODUCTION_SMTP_SSL=false \ PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \ +PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \ ./scripts/init-production-env.sh help.test "$external_production_env" >/dev/null ./scripts/validate-production-env.sh "$external_production_env" help.test >/dev/null external_split_production_env="$scan_dir/.env.production.external-db-split" @@ -139,6 +166,7 @@ PRODUCTION_SMTP_AUTH=always \ PRODUCTION_SMTP_TLS=always \ PRODUCTION_SMTP_SSL=false \ PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \ +PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \ ./scripts/init-production-env.sh help.test "$external_split_production_env" >/dev/null ./scripts/validate-production-env.sh "$external_split_production_env" help.test >/dev/null invalid_external_env="$scan_dir/.env.production.invalid-external-db" @@ -166,7 +194,8 @@ if ./scripts/init-production-env.sh help.test "$production_env" >/dev/null 2>&1; exit 1 fi incomplete_production_env="$scan_dir/.env.production.incomplete" -./scripts/init-production-env.sh help.test "$incomplete_production_env" >/dev/null +PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \ + ./scripts/init-production-env.sh help.test "$incomplete_production_env" >/dev/null if ./scripts/validate-production-env.sh \ "$incomplete_production_env" help.test >/dev/null 2>&1; then echo "Production environment validator accepted unresolved deployment inputs." >&2 diff --git a/scripts/validate-production-env.sh b/scripts/validate-production-env.sh index 2f5c026..f558256 100755 --- a/scripts/validate-production-env.sh +++ b/scripts/validate-production-env.sh @@ -103,6 +103,7 @@ email_from_address=$(require_value EMAIL_FROM_ADDRESS) support_inbox_address=$(optional_value SUPPORT_INBOX_ADDRESS) google_oauth_client_id=$(optional_value GOOGLE_OAUTH_CLIENT_ID) google_oauth_client_secret=$(optional_value GOOGLE_OAUTH_CLIENT_SECRET) +codex_session_id=$(require_value CODEX_SESSION_ID) [[ "$deployment_target" == compose ]] || { echo "Production Compose validation requires DEPLOYMENT_TARGET=compose." >&2 @@ -258,6 +259,14 @@ if [[ -n "$google_oauth_client_id" || -n "$google_oauth_client_secret" ]]; then reject_marker GOOGLE_OAUTH_CLIENT_SECRET "$google_oauth_client_secret" fi +case "$codex_session_id" in + not-configured | copy-the-main-local-codex-session-id) + echo "CODEX_SESSION_ID must identify the Build Week Codex session." >&2 + exit 1 + ;; +esac +reject_marker CODEX_SESSION_ID "$codex_session_id" + secrets=( "$secret_key_base" "$handover_secret"