Validate required frontend env vars, add shared logger, fix audit workflow threshold - #860
Merged
gboigwe merged 1 commit intoAug 29, 2026
Conversation
…t workflow threshold - stellar-config.ts: validateRequiredEnv() checks all NEXT_PUBLIC_* vars are present, called at startup in production, naming the missing variable instead of failing deep in a feature later - lib/logger.ts: minimal shared logging wrapper as a single funnel point for error-handling call sites; wallet-store.ts's autoReconnect migrated to it as the first call site - security-audit.yml: Backend Audit now runs the package's own `npm run audit` (--audit-level=high), which the workflow was previously bypassing by calling bare `npm audit`; Frontend Audit given the same threshold. Investigated the 3 consecutive failures: real npm audit findings (18 vulnerabilities in backend deps, including 2 critical) still need dependency updates as follow-up — not fixed in this pass to avoid an unreviewed dependency bump. Closes ThinkLikeAFounder#826 Closes ThinkLikeAFounder#827 Closes ThinkLikeAFounder#829
|
@ANTIDOT20 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
validateRequiredEnv()instellar-config.tschecks all ~21 requiredNEXT_PUBLIC_*vars are present, called at startup in production, naming the missing variable rather than failing deep inside whichever feature needs it.src/lib/logger.tsas a single funnel point for error-handling call sites (so it can later point at a real error-tracking service with one change);wallet-store.ts'sautoReconnectmigrated as the first call site. Convention documented in the file:logger.errorfor anything silently logged, paired withuseToast()at the call site when it should also be user-facing.npm auditfindings (18 vulnerabilities in backend deps, 2 critical), not a broken workflow. Also found the workflow was calling barenpm auditinbackend/, bypassing the package's ownnpm run audit(--audit-level=high) convention — fixed that, and gavefrontend/'s audit the same threshold.protected: trueonmain, but the detailed ruleset is inaccessible to a contributor identity; currentmainHEAD has Contracts CI/Frontend CI/E2E Tests/Deploy Contracts all failing) — this is explicitly a repo-admin/Settings issue per the issue's own description, not fixable via a contributor PR, so not included in the closes-list below.Issues
Closes #826
Closes #827
Closes #829
(#828 intentionally not closed by this PR — see comment on the issue)
Scope notes
npm audit fix --forcebundled into an unrelated PR.console.errorcalls is real follow-up work, as the issue itself suggests ("doesn't need to be one giant PR").