Require Build Week session ID for deployments

docs/operations.md

@@ -83,6 +83,7 @@ Create staging with independent names and secrets:
 PRODUCTION_COMPOSE_PROJECT_NAME=who_need_help_staging \
 PRODUCTION_PUBLIC_UPSTREAM_NAME=who-need-help-staging \
 PRODUCTION_HTTP_PORT=4011 \
+PRODUCTION_CODEX_SESSION_ID=YOUR_MAIN_CODEX_SESSION_ID \
 ./scripts/init-production-env.sh \
   staging.whoneedhelp.com .env.staging
 ```
@@ -93,6 +94,7 @@ Create production separately:
 PRODUCTION_COMPOSE_PROJECT_NAME=who_need_help_production \
 PRODUCTION_PUBLIC_UPSTREAM_NAME=who-need-help-production \
 PRODUCTION_HTTP_PORT=4010 \
+PRODUCTION_CODEX_SESSION_ID=YOUR_MAIN_CODEX_SESSION_ID \
 ./scripts/init-production-env.sh \
   whoneedhelp.com .env.production
 ```

scripts/init-production-env.sh

@@ -50,6 +50,12 @@ compose_project_name=${PRODUCTION_COMPOSE_PROJECT_NAME:-who_need_help}
 public_edge_enabled=${PRODUCTION_PUBLIC_EDGE_ENABLED:-true}
 public_edge_network=${PRODUCTION_PUBLIC_EDGE_NETWORK:-who_need_help_public_edge}
 public_upstream_name=${PRODUCTION_PUBLIC_UPSTREAM_NAME:-who-need-help-production}
+codex_session_id=${PRODUCTION_CODEX_SESSION_ID:-}
+
+if [ -z "$codex_session_id" ]; then
+  echo "PRODUCTION_CODEX_SESSION_ID is required for the Build Week feedback page." >&2
+  exit 1
+fi
 
 case "$compose_project_name" in
   *[!a-zA-Z0-9_-]* | '')
@@ -136,6 +142,7 @@ SMTP_TLS_VALUE=$smtp_tls \
 SMTP_SSL_VALUE=$smtp_ssl \
 EMAIL_FROM_ADDRESS_VALUE=$email_from_address \
 SUPPORT_INBOX_ADDRESS_VALUE=$support_inbox_address \
+CODEX_SESSION_ID_VALUE=$codex_session_id \
   awk '
     BEGIN {
       replacement["DEPLOYMENT_TARGET"] = "compose"
@@ -172,7 +179,7 @@ SUPPORT_INBOX_ADDRESS_VALUE=$support_inbox_address \
       replacement["SMTP_SSL"] = ENVIRON["SMTP_SSL_VALUE"]
       replacement["EMAIL_FROM_ADDRESS"] = ENVIRON["EMAIL_FROM_ADDRESS_VALUE"]
       replacement["SUPPORT_INBOX_ADDRESS"] = ENVIRON["SUPPORT_INBOX_ADDRESS_VALUE"]
-      replacement["CODEX_SESSION_ID"] = "not-configured"
+      replacement["CODEX_SESSION_ID"] = ENVIRON["CODEX_SESSION_ID_VALUE"]
     }
     {
       separator = index($0, "=")

scripts/quality.sh

@@ -101,6 +101,20 @@ if ./scripts/init-edge-env.sh help.test staging.help.test "$edge_env" >/dev/null
   exit 1
 fi
 production_env="$scan_dir/.env.production"
+missing_codex_env="$scan_dir/.env.production.missing-codex"
+if PRODUCTION_TRAEFIK_TRUSTED_IPS=172.20.0.1/32 \
+  PRODUCTION_SMTP_RELAY=smtp.help.test \
+  PRODUCTION_SMTP_PORT=587 \
+  PRODUCTION_SMTP_USERNAME=quality-user \
+  PRODUCTION_SMTP_PASSWORD=quality-password \
+  PRODUCTION_SMTP_AUTH=always \
+  PRODUCTION_SMTP_TLS=always \
+  PRODUCTION_SMTP_SSL=false \
+  PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \
+  ./scripts/init-production-env.sh help.test "$missing_codex_env" >/dev/null 2>&1; then
+  echo "Production environment initializer accepted a missing Codex session ID." >&2
+  exit 1
+fi
 PRODUCTION_TRAEFIK_TRUSTED_IPS=172.20.0.1/32 \
 PRODUCTION_SMTP_RELAY=smtp.help.test \
 PRODUCTION_SMTP_PORT=587 \
@@ -110,9 +124,21 @@ PRODUCTION_SMTP_AUTH=always \
 PRODUCTION_SMTP_TLS=always \
 PRODUCTION_SMTP_SSL=false \
 PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \
+PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \
   ./scripts/init-production-env.sh help.test "$production_env" >/dev/null
 test "$(stat -c '%a' "$production_env")" = 600
 ./scripts/validate-production-env.sh "$production_env" help.test >/dev/null
+placeholder_codex_env="$scan_dir/.env.production.placeholder-codex"
+cp "$production_env" "$placeholder_codex_env"
+chmod 600 "$placeholder_codex_env"
+sed -i \
+  's/^CODEX_SESSION_ID=.*/CODEX_SESSION_ID=copy-the-main-local-codex-session-id/' \
+  "$placeholder_codex_env"
+if ./scripts/validate-production-env.sh \
+  "$placeholder_codex_env" help.test >/dev/null 2>&1; then
+  echo "Production environment validator accepted the template Codex session ID." >&2
+  exit 1
+fi
 external_production_env="$scan_dir/.env.production.external-db"
 PRODUCTION_DATABASE_MODE=external \
 PRODUCTION_DATABASE_URL=ecto://quality:external-password@database.internal/who_need_help \
@@ -124,6 +150,7 @@ PRODUCTION_SMTP_AUTH=always \
 PRODUCTION_SMTP_TLS=always \
 PRODUCTION_SMTP_SSL=false \
 PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \
+PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \
   ./scripts/init-production-env.sh help.test "$external_production_env" >/dev/null
 ./scripts/validate-production-env.sh "$external_production_env" help.test >/dev/null
 external_split_production_env="$scan_dir/.env.production.external-db-split"
@@ -139,6 +166,7 @@ PRODUCTION_SMTP_AUTH=always \
 PRODUCTION_SMTP_TLS=always \
 PRODUCTION_SMTP_SSL=false \
 PRODUCTION_EMAIL_FROM_ADDRESS=contact@help.test \
+PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \
   ./scripts/init-production-env.sh help.test "$external_split_production_env" >/dev/null
 ./scripts/validate-production-env.sh "$external_split_production_env" help.test >/dev/null
 invalid_external_env="$scan_dir/.env.production.invalid-external-db"
@@ -166,6 +194,7 @@ if ./scripts/init-production-env.sh help.test "$production_env" >/dev/null 2>&1;
   exit 1
 fi
 incomplete_production_env="$scan_dir/.env.production.incomplete"
+PRODUCTION_CODEX_SESSION_ID=00000000-0000-0000-0000-000000000001 \
   ./scripts/init-production-env.sh help.test "$incomplete_production_env" >/dev/null
 if ./scripts/validate-production-env.sh \
   "$incomplete_production_env" help.test >/dev/null 2>&1; then

scripts/validate-production-env.sh

@@ -103,6 +103,7 @@ email_from_address=$(require_value EMAIL_FROM_ADDRESS)
 support_inbox_address=$(optional_value SUPPORT_INBOX_ADDRESS)
 google_oauth_client_id=$(optional_value GOOGLE_OAUTH_CLIENT_ID)
 google_oauth_client_secret=$(optional_value GOOGLE_OAUTH_CLIENT_SECRET)
+codex_session_id=$(require_value CODEX_SESSION_ID)
 
 [[ "$deployment_target" == compose ]] || {
   echo "Production Compose validation requires DEPLOYMENT_TARGET=compose." >&2
@@ -258,6 +259,14 @@ if [[ -n "$google_oauth_client_id" || -n "$google_oauth_client_secret" ]]; then
   reject_marker GOOGLE_OAUTH_CLIENT_SECRET "$google_oauth_client_secret"
 fi
 
+case "$codex_session_id" in
+  not-configured | copy-the-main-local-codex-session-id)
+    echo "CODEX_SESSION_ID must identify the Build Week Codex session." >&2
+    exit 1
+    ;;
+esac
+reject_marker CODEX_SESSION_ID "$codex_session_id"
+
 secrets=(
   "$secret_key_base"
   "$handover_secret"