Rename shared airtable secret#2813
Conversation
Render
Destroyed
Render
Destroyed
📝 WalkthroughWalkthroughRenames 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)apps/infra/Pulumi.prod.yamlTraceback (most recent call last): 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR renames the shared Airtable automation secret from
Confidence Score: 5/5This is a mechanical rename with no logic changes — safe to merge. Every reference to the old token name has been updated consistently across infra config, K8s secret definitions, service env var injections, the website env validation, the verifyPublicToken helper, and all associated tests. A codebase-wide search confirms no stale references remain in application code. The only leftover is the encrypted certificateCreationToken entry in Pulumi.prod.yaml, which the PR description explicitly flags for a follow-up cleanup and has no runtime impact since the Pulumi program no longer reads it. No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Airtable Automation] -->|HTTP request + token| B[tRPC Endpoint]
B --> C[verifyPublicToken]
C --> D{AIRTABLE_AUTOMATION_TOKEN\nconfigured?}
D -- No --> E[INTERNAL_SERVER_ERROR]
D -- Yes --> F{timingSafeEqual\npublicToken == secret?}
F -- No --> G[UNAUTHORIZED]
F -- Yes --> H[Proceed with handler]
subgraph Infra
I[Pulumi.prod.yaml\nairtableAutomationToken] -->|config.requireSecret| J[K8s Secret\nairtableautomationtoken-secret]
J -->|envVarSources| K[Pod env var\nAIRTABLE_AUTOMATION_TOKEN]
end
K --> C
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A[Airtable Automation] -->|HTTP request + token| B[tRPC Endpoint]
B --> C[verifyPublicToken]
C --> D{AIRTABLE_AUTOMATION_TOKEN\nconfigured?}
D -- No --> E[INTERNAL_SERVER_ERROR]
D -- Yes --> F{timingSafeEqual\npublicToken == secret?}
F -- No --> G[UNAUTHORIZED]
F -- Yes --> H[Proceed with handler]
subgraph Infra
I[Pulumi.prod.yaml\nairtableAutomationToken] -->|config.requireSecret| J[K8s Secret\nairtableautomationtoken-secret]
J -->|envVarSources| K[Pod env var\nAIRTABLE_AUTOMATION_TOKEN]
end
K --> C
Reviews (1): Last reviewed commit: "Update Pulumi with new secret" | Re-trigger Greptile |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/infra/Pulumi.prod.yaml`:
- Around line 57-58: Remove the superseded infra:airtableAutomationToken entry
from the Pulumi production configuration, while preserving
infra:certificateCreationToken and all other settings. Only retain the old
secret if a documented migration-retention requirement applies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 767c9c12-f0ce-42fb-aefd-cc66cae88c66
📒 Files selected for processing (8)
apps/infra/Pulumi.prod.yamlapps/infra/src/k8s/secrets.tsapps/infra/src/k8s/serviceDefinitions.tsapps/website/.env.testapps/website/src/lib/api/env.tsapps/website/src/lib/api/utils.test.tsapps/website/src/lib/api/utils.tsapps/website/src/server/routers/certificates.test.ts
| infra:airtableAutomationToken: | ||
| secure: v1:6tP/YKX2E+Gb4R26:Wrz1cPwU10jp4aydNBZG89RZRHcKEhUkDHlh+XiYebdh69+RWWRaaZpBrdlSD4O1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Remove the superseded Pulumi secret entry.
Adding infra:airtableAutomationToken while retaining infra:certificateCreationToken at Lines 31-32 leaves the old credential stored in Pulumi configuration. Delete the obsolete entry, unless a documented migration-retention window is required.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/infra/Pulumi.prod.yaml` around lines 57 - 58, Remove the superseded
infra:airtableAutomationToken entry from the Pulumi production configuration,
while preserving infra:certificateCreationToken and all other settings. Only
retain the old secret if a documented migration-retention requirement applies.
There was a problem hiding this comment.
Doing as a follow-up task
There was a problem hiding this comment.
@joshestein, acknowledged—this can remain as a follow-up. Would you like me to open a GitHub issue to track removal of infra:certificateCreationToken after the migration?
2 participants
Description
Make a follow-up PR to delete the same passphrase from Pulumi.
Issue
Fixes #2808
Developer checklist