Code review — deploy-time prod web config injection (GAC-48)

• Branch: ci/gac-48-web-env-inject → master
• Date: 2026-07-14
• Scope: 1 commit, 2 files (+85) — new scripts/inject-web-env.mjs, deploy.yml web-job wiring
• Reviewer: code-reviewer agent over git diff master...HEAD, synthesized.

Deterministic gate

Check	Result
nx lint web	✓
nx test web	✓
coverage gate (nx test web --configuration=coverage)	✓
nx build web	✓ (run twice — clean tree, and with injected values)
nx affected -t lint test build --base=master	✓ no projects affected (CI/scripts-only diff)
Go gates	n/a — apps/api untouched

What's in the batch

The code half of GAC-48 (tier C — web build-time values). environment.prod.ts deliberately ships empty supabaseUrl / supabaseAnonKey / apiUrl; nothing filled them at deploy time, so the web job produced an unconfigured bundle. Now:

• scripts/inject-web-env.mjs — reads DISPATCH_SUPABASE_URL, DISPATCH_SUPABASE_ANON_KEY, DISPATCH_API_URL; validates (https-only URLs, JWT or sb_publishable_… key shape); strips trailing slashes (consumers do apiUrl + path joins); rewrites the three literals in environment.prod.ts idempotently with an exactly-one-match guard; exits 1 loudly if anything is missing or malformed so a half-configured deploy cannot ship.
• deploy.yml — web job runs the script between bun install and bunx nx build web, fed from GitHub Actions repository variables (not secrets — all three values are publishable and ship in the browser bundle by design); header comment documents them.

End-to-end verification

Missing vars → exit 1 listing all three · http:// URL → rejected · truncated anon key → rejected · valid values → exactly 3 lines changed, trailing slash stripped · re-run with different values → clean overwrite (idempotent) · nx build web (production, fileReplacements confirmed active via defaultConfiguration) → injected values present in dist/apps/web/browser/chunk-*.js · env file restored afterwards.

Findings

🔴 Blocking — none.

🟡 Should-fix — none.

🟢 Nit (resolved in-branch)

1. ANON_KEY regex looser than its comment claimed — accepted any alnum string, so a truncated copy-paste key would pass. FIXED — now requires three dot-separated base64url segments (JWT) or sb_publishable_ + ≥8 chars; truncated-key rejection re-verified.

Checked and clean

$-in-replacement / quote-injection into the TS literal (both excluded by validation char classes, validation runs before splice); fail-loud ordering (validation precedes any file write; no continue-on-error on the step); GH Actions script-injection surface (values passed via env:, never interpolated into run:); job ordering unchanged (web needs supabase only).

Note: the VS Code Actions extension warns "Context access might be invalid" on the three vars.* references — expected until the repository variables are created (GAC-48 ops half).

Verdict

Green. Deterministic gate passed, no blocking or should-fix findings, the one nit fixed and re-verified. Remaining GAC-48 work is operational (create the six Actions secrets + three repository variables, set Fly secrets, run deploy.yml, tag phase-1).