Harden Railway deployment DB secrets#95
Open
willjy1 wants to merge 3 commits into
Open
Conversation
68 tasks
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughReplaces hardcoded DB and Redis credentials with Railway environment variables in PHP config and deployment scripts, adds docs describing required runtime variables, centralizes MySQL calls via run_mysql (using MYSQL_PWD), and adds a Python test to enforce these rules. ChangesRailway Database Runtime Secrets
Sequence DiagramsequenceDiagram
participant DevDeploymentScript
participant Environment
participant run_mysql
participant MySQLClient
DevDeploymentScript->>Environment: Read MYSQL_HOST/PORT/USER/DATABASE (with defaults)
DevDeploymentScript->>Environment: Require MYSQL_PASSWORD (fail if missing)
DevDeploymentScript->>run_mysql: Call run_mysql -e "SELECT 1"
run_mysql->>run_mysql: Set MYSQL_PWD from environment
run_mysql->>MySQLClient: Invoke mysql with host/port/user (uses MYSQL_PWD)
MySQLClient-->>run_mysql: Return result
run_mysql-->>DevDeploymentScript: Exit with status
DevDeploymentScript->>run_mysql: Call run_mysql "$MYSQL_DATABASE" -e "ALTER TABLE..."
run_mysql->>MySQLClient: Execute schema changes
MySQLClient-->>run_mysql: Confirm
🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/check-railway-db-runtime-secrets.py`:
- Around line 18-23: Replace the hard-coded FORBIDDEN_SECRET_FRAGMENTS list with
a runtime-loaded source (e.g., read a CI-provided environment variable like
FORBIDDEN_SECRET_FRAGMENTS, split it, or load from a secure file) and update any
tests/logic that reference FORBIDDEN_SECRET_FRAGMENTS (including the occurrences
around lines 68-69) to use that runtime value; when reporting failures, never
log or assert the raw fragment strings — instead report counts or use a masked
representation (e.g., show only prefix/suffix or a fixed placeholder) so
secret-like values are not printed to logs or git history.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 201d38c9-e69d-420a-9644-192dc5bcb587
📒 Files selected for processing (7)
docs/railway-db-runtime-secrets.mdenvironments/dev-server-railway/common/config/main-local.phpenvironments/dev-server-railway/deployments/july_2025/29_july_2025_deployment.shenvironments/dev-server-railway/deployments/july_2025/3_july_2025_deployment.shenvironments/prod-railway/deployments/july_2025/29_july_2025_deployment.shenvironments/prod-railway/deployments/july_2025/3_july_2025_deployment.shtests/check-railway-db-runtime-secrets.py
willjy1
force-pushed
the
codex/harden-railway-deployment-db-secrets
branch
from
e2a3e4e to
b11f8db
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
tests/check-railway-db-runtime-secrets.py (1)
94-106: ⚡ Quick winMake secret-source checks tolerant to equivalent PHP formatting.
These assertions depend on exact quoting/spacing (
getenv('...'),'password' => getenv('...')), so harmless formatting changes can fail CI even when behavior is correct.Proposed fix
+import re @@ for name in DEV_CONFIG_ENV_VARS: - require(f"getenv('{name}')" in config, f"Dev Railway config must use getenv('{name}').") + require( + re.search(rf"getenv\(\s*['\"]{re.escape(name)}['\"]\s*\)", config) is not None, + f"Dev Railway config must use getenv('{name}').", + ) require(f"`{name}`" in doc, f"Docs must mention `{name}`.") @@ for component, env_var in COMPONENT_PASSWORD_ENV.items(): block = component_block(config, component) require( - f"'password' => getenv('{env_var}')" in block, + re.search( + rf"'password'\s*=>\s*getenv\(\s*['\"]{re.escape(env_var)}['\"]\s*\)", + block, + ) is not None, f"{component} password must come from getenv('{env_var}').", ) - require("'password' => '" not in block, f"{component} password must not be an inline literal.") - require("'password' => \"" not in block, f"{component} password must not be an inline literal.") + require( + re.search(r"'password'\s*=>\s*['\"]", block) is None, + f"{component} password must not be an inline literal.", + )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/check-railway-db-runtime-secrets.py` around lines 94 - 106, The current tests iterate DEV_CONFIG_ENV_VARS and COMPONENT_PASSWORD_ENV and use exact string checks (e.g. require(f"getenv('{name}')" in config) and require(f"'password' => getenv('{env_var}')" in block)) which break on harmless PHP formatting differences; update the assertions in the loop that references DEV_CONFIG_ENV_VARS, COMPONENT_PASSWORD_ENV and component_block() to use case-sensitive regex matching that tolerates single or double quotes, optional whitespace around => and parentheses, and optional spaces after getenv (e.g. pattern like r"getenv\(\s*['\"]{name}['\"]\s*\)" and r"['\"]password['\"]\s*=>\s*getenv\(\s*['\"]{env_var}['\"]\s*\)"), and replace the existing literal "in" checks with a regex search that preserves the same failure messages.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/check-railway-db-runtime-secrets.py`:
- Around line 54-56: When FORBIDDEN_SECRET_FRAGMENTS_FILE is set but unreadable,
the current Path(fragment_file).read_text call will raise a raw traceback; wrap
the read in a controlled check: verify Path(fragment_file).exists() and
is_file() (or wrap read_text in try/except), and on any failure call pytest.fail
with a clear regression-check message that includes the fragment_file path;
update the fragment_file/fragments handling so fragments.extend(...) only runs
after the existence/read succeeds and any exceptions are caught and converted to
pytest.fail.
---
Nitpick comments:
In `@tests/check-railway-db-runtime-secrets.py`:
- Around line 94-106: The current tests iterate DEV_CONFIG_ENV_VARS and
COMPONENT_PASSWORD_ENV and use exact string checks (e.g.
require(f"getenv('{name}')" in config) and require(f"'password' =>
getenv('{env_var}')" in block)) which break on harmless PHP formatting
differences; update the assertions in the loop that references
DEV_CONFIG_ENV_VARS, COMPONENT_PASSWORD_ENV and component_block() to use
case-sensitive regex matching that tolerates single or double quotes, optional
whitespace around => and parentheses, and optional spaces after getenv (e.g.
pattern like r"getenv\(\s*['\"]{name}['\"]\s*\)" and
r"['\"]password['\"]\s*=>\s*getenv\(\s*['\"]{env_var}['\"]\s*\)"), and replace
the existing literal "in" checks with a regex search that preserves the same
failure messages.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2450e02f-c82b-4deb-8d11-5b75e059dde0
📒 Files selected for processing (7)
docs/railway-db-runtime-secrets.mdenvironments/dev-server-railway/common/config/main-local.phpenvironments/dev-server-railway/deployments/july_2025/29_july_2025_deployment.shenvironments/dev-server-railway/deployments/july_2025/3_july_2025_deployment.shenvironments/prod-railway/deployments/july_2025/29_july_2025_deployment.shenvironments/prod-railway/deployments/july_2025/3_july_2025_deployment.shtests/check-railway-db-runtime-secrets.py
✅ Files skipped from review due to trivial changes (1)
- docs/railway-db-runtime-secrets.md
🚧 Files skipped from review as they are similar to previous changes (5)
- environments/prod-railway/deployments/july_2025/3_july_2025_deployment.sh
- environments/dev-server-railway/common/config/main-local.php
- environments/dev-server-railway/deployments/july_2025/3_july_2025_deployment.sh
- environments/dev-server-railway/deployments/july_2025/29_july_2025_deployment.sh
- environments/prod-railway/deployments/july_2025/29_july_2025_deployment.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to #55
/claim #55
Scope
This is a narrow Railway deployment DB runtime-secret hardening slice. It does not touch S3/AWS keys, SQS/EventManager, MediaConvert, SES/mailers, Xero, Cloudinary, OneSignal, Civil ID upload/remove flows, live Railway/database access, candidate data, or real credential values.
Summary
MYSQL_PASSWORDat runtime and pass it viaMYSQL_PWDinstead of the mysql command-line-p...argument.Verification
php -lcould not be run here because PHP is not installed in this environment. The PHP change is limited to replacing literal config values with existinggetenv(...)-style config expressions.Safety boundary
No live Railway, database, Redis, AWS/IAM/S3, candidate data, private exports, screenshots, or credential values were accessed or included.
Transparency: automation-assisted; I reviewed the diff and verification before submitting.
Summary by CodeRabbit
Documentation
Chores
Tests