docs: Secret-not-Plain-text token, R2 optional, VITE_API_BASE for web build#8
Merged
Conversation
…VITE_API_BASE for web build - DISCORD_BOT_TOKEN: the dashboard variable MUST be type Secret, not Plain text. Plain-text vars are wiped on every wrangler deploy (wrangler.toml is the source of truth); secrets persist. A downstream admin hit exactly this — token vanished on each Workers Builds redeploy because it was set as Plain text. - R2 is optional: mark it so in the section-0 inventory and both R2-creation steps (drop [[r2_buckets]] to skip), and in both READMEs' provision notes. - web build now hard-fails without VITE_API_BASE (vite.config.ts), so the README quick-start/deploy commands and the DEPLOY.md Pages note now pass/explain it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Doc-only follow-ups (closes the remaining items #2/#5/#6 from the fork-fidelity review). No code/runtime changes.
#2 — DISCORD_BOT_TOKEN must be a Secret, not Plain text (confirmed root cause)
A downstream admin's bot token vanished on every Workers Builds redeploy. Root cause (confirmed by him re-setting it as Secret → now persists): he'd added it as a Plain text variable.
wrangler deploytreatswrangler.tomlas the source of truth for runtime vars and wipes any dashboard Plain-text var not in the config on each deploy; secrets are never wiped. Our guideline said "Secret" but didn't warn against Plain text or explain why.docs/DEPLOY.md6-1: explicit Type: Secret (not Plain text) + a warning explaining the wipe.#6 — R2 is optional, say so consistently
docs/DEPLOY.mdsection-0 inventory + both R2-creation steps now mark R2 optional (drop[[r2_buckets]]to skip).#5 — web build requires VITE_API_BASE
Since the build now hard-fails without
VITE_API_BASE(merged in #7), the barepnpm --filter @chippot/web buildin the READMEs would fail. Updated quick-start + deploy commands inREADME.md/README.zh-TW.mdto pass it, and updated the DEPLOY.md Pages note + FAQ to say the build now fail-fasts (instead of shipping a white-screen bundle).Docs only — CI (typecheck/test/build) unaffected; no production deploy.