docs(release): harden the production migration runbook #256
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint — no DEV_BYPASS_AUTH references outside src/auth/middleware.ts | |
| # Plan reference: | |
| # plans/2026-05-12-002-feat-managed-agents-full-migration-plan.md §10 + Step 4 | |
| # | |
| # Why this exists: | |
| # `DEV_BYPASS_AUTH=demo-a` is a local-only escape hatch that skips | |
| # WorkOS sign-in during the migration's inner loop (Steps 6-10). It is | |
| # read in exactly one place: `src/auth/middleware.ts:getDevBypassAuth()`. | |
| # If a reference leaks into a server fn, route loader, or component, | |
| # the bypass could grant production access on a misconfigured Vercel | |
| # env var. This workflow fails the build if any other file mentions | |
| # the literal string. | |
| # | |
| # Allowed references: | |
| # - src/auth/middleware.ts (the canonical single read) | |
| # - plan/docs files (explanatory references) | |
| # - this workflow file (the literal name appears in error messages) | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-no-dev-bypass-leak: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Scan for stray DEV_BYPASS_AUTH env-var reads | |
| run: | | |
| set -e | |
| # Look for `process.env.DEV_BYPASS_AUTH` reads in src/test/scripts. | |
| # The only legal read is in `src/auth/middleware.ts:getDevBypassAuth()`. | |
| # Documentation mentions / error-message references of the literal name | |
| # are allowed elsewhere. | |
| OFFENDERS=$(grep -rln 'process\.env\.DEV_BYPASS_AUTH' src test scripts 2>/dev/null \ | |
| | grep -v '^src/auth/middleware\.ts$' \ | |
| || true) | |
| if [ -n "$OFFENDERS" ]; then | |
| echo "::error::process.env.DEV_BYPASS_AUTH read outside src/auth/middleware.ts:" | |
| echo "$OFFENDERS" | |
| exit 1 | |
| fi | |
| echo "OK: process.env.DEV_BYPASS_AUTH is only read in src/auth/middleware.ts." |