Skip to content

Remove SST runtime integration#61

Merged
sydneyrenee merged 4 commits into
devfrom
solaceproject/remove-sst
May 31, 2026
Merged

Remove SST runtime integration#61
sydneyrenee merged 4 commits into
devfrom
solaceproject/remove-sst

Conversation

@sydneyrenee
Copy link
Copy Markdown
Member

Summary

  • remove the SST package, generated ambient files, and SST shell/secret scripts
  • replace direct SST resource access with environment-backed resource bindings and worker env bindings
  • remove SST-branded docs/examples/social-card endpoints and command arity entries

Verification

  • bun typecheck
  • git diff --check
  • bun test test/cli/github-remote.test.ts (from packages/emberharmony)
  • bun --filter @thesolaceproject/emberharmony-console-app build
  • bun --filter @thesolaceproject/emberharmony-web build

Notes

  • bun install --lockfile-only --ignore-scripts is still blocked by existing fatal OSV advisories for devalue and js-cookie, so the lockfile SST removal was applied directly.
  • bun --filter @thesolaceproject/emberharmony-enterprise build still fails in the existing SSR Shiki wasm path: Vite cannot load shiki/dist/onig.wasm without a wasm plugin or ?url/?init handling.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request removes the dependency on SST (Serverless Stack) across the monorepo, replacing auto-generated SST resources with local environment-variable-based configurations and updating references from SST to EmberHarmony. The code review identified a critical authentication bypass vulnerability in the API's admin secret verification when the environment variable is undefined. Additionally, several medium-severity issues were found in the new environment variable helper functions in drizzle.config.ts and resource.node.ts, where empty strings (such as empty database passwords or ports) are incorrectly treated as falsy, potentially causing configuration failures or defaulting the database port to 0.

Comment thread packages/function/src/api.ts Outdated
Comment thread packages/console/core/drizzle.config.ts Outdated
Comment thread packages/console/core/drizzle.config.ts Outdated
Comment thread packages/console/resource/resource.node.ts Outdated
Comment thread packages/console/resource/resource.node.ts Outdated
@sydneyrenee sydneyrenee merged commit ef1b79d into dev May 31, 2026
8 checks passed
@sydneyrenee sydneyrenee deleted the solaceproject/remove-sst branch May 31, 2026 06:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant