fix: unify env var configuration -- API_KEY mismatch, missing vars (OPE-72)#258
Conversation
…sing vars, stale references Problems fixed: 1. API_KEY vs DEV_API_KEY: .env.example had API_KEY but backend reads DEV_API_KEY. docker-compose passed API_KEY which backend ignored. Now .env.example documents DEV_API_KEY with clear dev-only warning. 2. EMBEDDING_MODEL mismatch: .env.example said text-embedding-3-large but code defaults to text-embedding-3-small. Aligned to match code. 3. Missing vars: added DEV_API_KEY, DEBUG, LOG_LEVEL, REDIS_URL to .env.example. Self-hosters can now see every configurable option. 4. Dead env vars: removed SUPABASE_KEY and API_KEY from conftest (nobody reads them). 5. docker-compose: passes DEV_API_KEY + DEBUG + EMBEDDING_MODEL now. 6. startup_checks: added GITHUB_CLIENT_ID/SECRET and DISCORD_FEEDBACK_WEBHOOK to optional vars. 284 tests pass. Closes OPE-72
|
@DevanshuNEU is attempting to deploy a commit to the Dev's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis pull request updates environment variable configuration across the project. Changes include transitioning from a generic Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@CodeRabbit review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
docker-compose.yml (2)
38-46:⚠️ Potential issue | 🟠 Major
GITHUB_CLIENT_ID,GITHUB_CLIENT_SECRET, andLOG_LEVELare not forwarded into the container.Every other optional service variable (
DISCORD_FEEDBACK_WEBHOOK,COHERE_API_KEY,VOYAGE_API_KEY,SENTRY_DSN) is passed through, but the GitHub OAuth pair and the log-level control are absent. A self-hoster who sets these in their.envfile will have GitHub OAuth silently disabled inside Docker and no way to adjust log verbosity without editingdocker-compose.ymlmanually.🐛 Proposed fix
- DISCORD_FEEDBACK_WEBHOOK=${DISCORD_FEEDBACK_WEBHOOK} + - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID} + - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET} + - GITHUB_REDIRECT_URI=${GITHUB_REDIRECT_URI} + - LOG_LEVEL=${LOG_LEVEL:-INFO} - COHERE_API_KEY=${COHERE_API_KEY}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker-compose.yml` around lines 38 - 46, Add the missing environment variable pass-throughs for GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and LOG_LEVEL to the service's environment block so values from the .env are available inside the container; specifically, add entries referencing ${GITHUB_CLIENT_ID} and ${GITHUB_CLIENT_SECRET} and a LOG_LEVEL entry (with a sensible default like info) alongside the existing variables (DEV_API_KEY, DEBUG, EMBEDDING_MODEL, BACKEND_API_URL, etc.) to ensure GitHub OAuth and runtime log verbosity are configurable without editing docker-compose.yml.
100-102:⚠️ Potential issue | 🟡 MinorStale
API_KEYreference in the commented-out MCP server block.Line 101 still reads
- API_KEY=${API_KEY}, which references the old variable that this PR removes. Anyone who uncomments this service will inherit the wrong key name.🐛 Proposed fix
- # - API_KEY=${API_KEY} + # - DEV_API_KEY=${DEV_API_KEY}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker-compose.yml` around lines 100 - 102, The commented-out MCP server block still contains a stale environment variable reference "- API_KEY=${API_KEY}"; update that commented line in the MCP server block to either remove the stale API_KEY reference or replace it with the current environment variable name used elsewhere (e.g., the new key name used by the MCP service) so that uncommenting the service will not inject the wrong variable; locate the commented line "- API_KEY=${API_KEY}" and modify or delete it accordingly.
🧹 Nitpick comments (3)
.env.example (2)
49-54:ENVIRONMENTis stranded in the Sentry block; consider moving it nearDEBUG/LOG_LEVEL.Logically
ENVIRONMENT=developmentbelongs alongside the other runtime-mode vars (DEBUG,LOG_LEVEL). Its current placement afterSENTRY_INCLUDE_LOCAL_VARSalso triggers two additionalUnorderedKeylinter warnings (lines 53–54):SENTRY_INCLUDE_LOCAL_VARSmust precedeSENTRY_SEND_PII, andENVIRONMENTmust precedeSENTRY_DSN, becauseI < SandE < Salphabetically within the group.♻️ Proposed fix
DEBUG=false DEV_API_KEY= LOG_LEVEL=INFO +ENVIRONMENT=development # Backend API URL (used by MCP server and frontend)SENTRY_DSN= -SENTRY_SEND_PII=false SENTRY_INCLUDE_LOCAL_VARS=false -ENVIRONMENT=development +SENTRY_SEND_PII=false🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.env.example around lines 49 - 54, ENVIRONMENT is misplaced inside the Sentry block causing logical grouping and linter UnorderedKey warnings; move the ENVIRONMENT variable out of the Sentry section and place it alongside the runtime-mode vars such as DEBUG and LOG_LEVEL, and also reorder the Sentry keys so SENTRY_INCLUDE_LOCAL_VARS precedes SENTRY_SEND_PII and ENVIRONMENT precedes SENTRY_DSN to satisfy alphabetical ordering; update the .env.example by relocating ENVIRONMENT next to DEBUG/LOG_LEVEL and reordering SENTRY_DSN, SENTRY_SEND_PII, and SENTRY_INCLUDE_LOCAL_VARS accordingly.
24-28:DEBUGshould precedeDEV_API_KEYwithin the group to fix the linter warning.Within a blank-line-separated group dotenv-linter expects alphabetical ordering;
DEBUG(DEB…) sorts beforeDEV_API_KEY(DEV…).♻️ Proposed fix
-DEV_API_KEY= -DEBUG=false -LOG_LEVEL=INFO +DEBUG=false +DEV_API_KEY= +LOG_LEVEL=INFO🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.env.example around lines 24 - 28, The env group is out of alphabetical order and triggers dotenv-linter; swap the two keys so that DEBUG comes before DEV_API_KEY (i.e., reorder the variables named DEBUG and DEV_API_KEY within the same blank-line-separated block) to satisfy the linter and maintain the intended comment semantics.backend/config/startup_checks.py (1)
21-32: Four new vars introduced in this PR are absent fromOPTIONAL_VARS.
DEV_API_KEY,DEBUG,LOG_LEVEL, andREDIS_URLare all newly documented in.env.exampleand wired throughdocker-compose.ymlby this PR, but none of them appear inOPTIONAL_VARS. Self-hosters will receive no startup warning if they forget to set them.♻️ Proposed additions
("REDIS_HOST", "Redis host for caching", "Using default localhost"), + ("REDIS_URL", "Redis connection URL (e.g. Railway)", "Using REDIS_HOST/PORT instead"), + ("DEV_API_KEY", "Dev API key to bypass JWT auth when DEBUG=true", "Dev auth bypass disabled"), + ("DEBUG", "Enable debug mode", "Debug mode off"), + ("LOG_LEVEL", "Application log level", "Using default INFO"), ("GITHUB_CLIENT_ID", "GitHub OAuth client ID", "GitHub repo import disabled"),Based on learnings: "Add new required/optional environment variables to
config/startup_checks.py".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@backend/config/startup_checks.py` around lines 21 - 32, OPTIONAL_VARS in startup_checks.py is missing four newly introduced environment variables (DEV_API_KEY, DEBUG, LOG_LEVEL, REDIS_URL); update the OPTIONAL_VARS list to include entries for each of these with a short human-readable description and a fallback message (e.g., "Development API key", "Debug mode", "Log level", "Redis connection URL" and appropriate fallback notes) so startup_checks.py will warn users if they forget to set them; edit the OPTIONAL_VARS tuple defined in config/startup_checks.py to append these four tuples.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@docker-compose.yml`:
- Around line 38-46: Add the missing environment variable pass-throughs for
GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and LOG_LEVEL to the service's
environment block so values from the .env are available inside the container;
specifically, add entries referencing ${GITHUB_CLIENT_ID} and
${GITHUB_CLIENT_SECRET} and a LOG_LEVEL entry (with a sensible default like
info) alongside the existing variables (DEV_API_KEY, DEBUG, EMBEDDING_MODEL,
BACKEND_API_URL, etc.) to ensure GitHub OAuth and runtime log verbosity are
configurable without editing docker-compose.yml.
- Around line 100-102: The commented-out MCP server block still contains a stale
environment variable reference "- API_KEY=${API_KEY}"; update that commented
line in the MCP server block to either remove the stale API_KEY reference or
replace it with the current environment variable name used elsewhere (e.g., the
new key name used by the MCP service) so that uncommenting the service will not
inject the wrong variable; locate the commented line "- API_KEY=${API_KEY}" and
modify or delete it accordingly.
---
Nitpick comments:
In @.env.example:
- Around line 49-54: ENVIRONMENT is misplaced inside the Sentry block causing
logical grouping and linter UnorderedKey warnings; move the ENVIRONMENT variable
out of the Sentry section and place it alongside the runtime-mode vars such as
DEBUG and LOG_LEVEL, and also reorder the Sentry keys so
SENTRY_INCLUDE_LOCAL_VARS precedes SENTRY_SEND_PII and ENVIRONMENT precedes
SENTRY_DSN to satisfy alphabetical ordering; update the .env.example by
relocating ENVIRONMENT next to DEBUG/LOG_LEVEL and reordering SENTRY_DSN,
SENTRY_SEND_PII, and SENTRY_INCLUDE_LOCAL_VARS accordingly.
- Around line 24-28: The env group is out of alphabetical order and triggers
dotenv-linter; swap the two keys so that DEBUG comes before DEV_API_KEY (i.e.,
reorder the variables named DEBUG and DEV_API_KEY within the same
blank-line-separated block) to satisfy the linter and maintain the intended
comment semantics.
In `@backend/config/startup_checks.py`:
- Around line 21-32: OPTIONAL_VARS in startup_checks.py is missing four newly
introduced environment variables (DEV_API_KEY, DEBUG, LOG_LEVEL, REDIS_URL);
update the OPTIONAL_VARS list to include entries for each of these with a short
human-readable description and a fallback message (e.g., "Development API key",
"Debug mode", "Log level", "Redis connection URL" and appropriate fallback
notes) so startup_checks.py will warn users if they forget to set them; edit the
OPTIONAL_VARS tuple defined in config/startup_checks.py to append these four
tuples.
ℹ️ Review info
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.env.examplebackend/config/startup_checks.pybackend/tests/conftest.pydocker-compose.yml
…e, remove stale API_KEY 1. docker-compose: added GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GITHUB_REDIRECT_URI, LOG_LEVEL. GitHub OAuth was broken in Docker. 2. docker-compose: removed stale API_KEY= from commented MCP block (we renamed to DEV_API_KEY but missed this comment). 284 tests pass.
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.env.example (1)
44-47: Consider adding REDIS_URL to startup checks.Since REDIS_URL is now documented for hosted deployments, consider including it in
backend/config/startup_checks.pyoptional warnings for parity.Based on learnings: Add new required/optional environment variables to `config/startup_checks.py`.➕ Optional startup_checks addition
OPTIONAL_VARS: List[Tuple[str, str, str]] = [ ("SUPABASE_SERVICE_ROLE_KEY", "Supabase service role key", "Using anon key as fallback"), ("COHERE_API_KEY", "Cohere API key for reranking", "Search reranking disabled"), ("VOYAGE_API_KEY", "Voyage AI key for code embeddings", "Using OpenAI embeddings"), ("SENTRY_DSN", "Sentry DSN for error tracking", "Error tracking disabled"), ("SENTRY_SEND_PII", "Send user emails to Sentry", "PII disabled (privacy safe)"), ("SENTRY_INCLUDE_LOCAL_VARS", "Include local vars in Sentry traces", "Local vars excluded"), ("REDIS_HOST", "Redis host for caching", "Using default localhost"), + ("REDIS_URL", "Redis URL for hosted deployments", "Using REDIS_HOST/REDIS_PORT"), ("GITHUB_CLIENT_ID", "GitHub OAuth client ID", "GitHub repo import disabled"), ("GITHUB_CLIENT_SECRET", "GitHub OAuth client secret", "GitHub repo import disabled"), ("DISCORD_FEEDBACK_WEBHOOK", "Discord webhook for feedback", "Feedback notifications disabled"), ]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.env.example around lines 44 - 47, The startup checks are missing REDIS_URL as an optional environment variable; update the startup_checks module to include REDIS_URL in the optional checks list and warning logic. Locate the function or constant that defines optional env vars/warnings (e.g., OPTIONAL_ENV_VARS, get_optional_env_warnings, or register_optional_checks) and add an entry for REDIS_URL with a concise message recommending setting it for hosted deployments (parity with .env.example); ensure the new check reads from os.environ and surfaces a non-fatal warning rather than failing startup.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.env.example:
- Around line 24-28: Reorder keys in .env.example to satisfy dotenv-linter: move
DEBUG so it appears before DEV_API_KEY (i.e., put DEBUG line above DEV_API_KEY)
and ensure ENVIRONMENT is placed before any Sentry-related keys (e.g.,
SENTRY_DSN, SENTRY_ENVIRONMENT) so ENVIRONMENT precedes those; make the same
ordering change at the second occurrence mentioned (around the other block at
line ~54). Update only the key order, preserving values/comments.
In `@docker-compose.yml`:
- Around line 38-40: The backend docker-compose service is not passing LOG_LEVEL
through to the container even though backend/services/observability.py reads
LOG_LEVEL; update the service's environment block (the same block that contains
DEV_API_KEY, DEBUG and EMBEDDING_MODEL) to include LOG_LEVEL with a sensible
default (e.g. LOG_LEVEL=${LOG_LEVEL:-info}) so the container receives the
variable.
---
Nitpick comments:
In @.env.example:
- Around line 44-47: The startup checks are missing REDIS_URL as an optional
environment variable; update the startup_checks module to include REDIS_URL in
the optional checks list and warning logic. Locate the function or constant that
defines optional env vars/warnings (e.g., OPTIONAL_ENV_VARS,
get_optional_env_warnings, or register_optional_checks) and add an entry for
REDIS_URL with a concise message recommending setting it for hosted deployments
(parity with .env.example); ensure the new check reads from os.environ and
surfaces a non-fatal warning rather than failing startup.
ℹ️ Review info
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.env.examplebackend/config/startup_checks.pybackend/tests/conftest.pydocker-compose.yml
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
1 participant
Problem
Env var configuration was broken for self-hosters:
Fix
4 files changed. 284 tests pass.
Closes OPE-72
Summary by CodeRabbit