Provision GitHub gatekeeper OAuth credentials in previews - #419
Provision GitHub gatekeeper OAuth credentials in previews#419Maximo-Guk wants to merge 1 commit into
Conversation
The GitHub gatekeeper deploys into every preview unconfigured today, so connecting it there throws "The GitHub gatekeeper is not configured." on the first click. Upload CLIENT_ID/CLIENT_SECRET to that worker's Previews settings when a preview OAuth app is configured, the same way and for the same reason the backend's admins and Access pair already travel: Wrangler prints what it finds in a config, and this workflow's logs are public. The pair is resolved before any config is written, so a renamed secret fails the deploy rather than a preview, and is uploaded before the gatekeeper's own preview, since a preview inherits the Previews settings that exist when it is created. uploadBackendSecrets was already the whole of that dance, including the baseline self-heal, so it becomes uploadPreviewSecrets and takes the worker. Optional per gatekeeper, unlike the Access pair: unset, the preview still deploys and only that connector is dead. Half-set throws. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Preview:
|
![ask-bonk[bot]](https://avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
| // Before this gatekeeper's preview, not after, and for the same reason the backend's go | ||
| // before its own: a preview inherits the Previews settings that exist when it is created. | ||
| const oauth = oauthApps.get(pkg.name); | ||
| if (oauth) await uploadPreviewSecrets(pkg, wrangler.command, oauth); |
There was a problem hiding this comment.
When both repository secrets are later unset, oauth is absent and this skips reconciliation entirely. The pinned Wrangler preview secret bulk command merge-patches the worker Preview defaults, so omitted keys are preserved; every future GitHub preview will therefore keep inheriting the old credentials despite the resolver claiming the connector is unconfigured. Please explicitly upload CLIENT_ID: null and CLIENT_SECRET: null (or otherwise delete those defaults) for the unconfigured case.
|
Posted 1 actionable inline finding. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| console.warn(`${envPrefix}_CLIENT_ID is unset: ${pkgName} is deployed unconfigured, and ` + | ||
| "connecting it in this preview will fail."); |
There was a problem hiding this comment.
🟡 Removed OAuth credentials remain active
When both repository secrets are removed, addOAuthApp leaves no cleanup instruction, so deployment skips this worker. Existing Preview settings retain the old OAuth credentials.
Prompt for agents
Treat an explicitly unconfigured GitHub OAuth app as desired empty state, not as no work. scripts/preview/staging-config.ts currently omits gatekeeper-github from resolveGatekeeperSecrets when both environment values are absent, and scripts/preview/preview.ts interprets omission by skipping all Wrangler secret operations. Worker-level Preview settings survive deployments, so previously uploaded CLIENT_ID and CLIENT_SECRET remain inherited. Extend the resolved state and deployment flow to delete both Preview secrets when absent, while preserving pair validation and handling a missing baseline worker safely. Add a test covering a transition from configured to unconfigured settings.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Uploads
CLIENT_ID/CLIENT_SECRETto the GitHub gatekeeper's Previews settings whenPREVIEW_GITHUB_CLIENT_ID/PREVIEW_GITHUB_CLIENT_SECRETare set, so the connector works in a preview instead of throwing "not configured".