fix(compose): make the worker opt-in and require an explicit Supabase URL by BigSimmo · Pull Request #3642 · BigSimmo/PsychSift

BigSimmo · 2026-10-18T09:28:40Z

Summary

Docker review finding: a local docker compose up with production keys in .env.local started a worker that claims from the live ingestion queue, and the app build silently defaulted NEXT_PUBLIC_SUPABASE_URL to the production project.

Remove the production Supabase URL default (sjrfecxgysukkwxsowpy). Compose now fails fast (${NEXT_PUBLIC_SUPABASE_URL:?...}) unless the variable is supplied.
Put worker behind profiles: [worker] and drop the app's depends_on: worker, so a plain up starts the app only.
Remove the obsolete version: "3.8".
env_file: [{ path: .env.local, required: false }] for both services.
Worker: set WORKER_HEALTH_PORT=3901 (internal only, nothing published; not 8080 so the Medications sibling port-isolation audit does not flag a collision) so worker/health.ts binds, and add a Compose healthcheck on /health.
README Compose section: opt-in worker (--profile worker), and --env-file .env.local for both up and down (the down fix came from the Qodo review bot), because ${...} interpolation does not read env_file.

Areas touched: Delivery and assurance, Knowledge and records

Verification

docker compose config -q (compose v2.39.4) with no NEXT_PUBLIC_SUPABASE_URL → required variable NEXT_PUBLIC_SUPABASE_URL is missing a value (exit 1)
With the URL set: config --services → app only; --profile worker config --services → app, worker; no depends_on in the rendered config; config renders without a .env.local file present
prettier --check README.md docker-compose.yml → All matched files use Prettier code style!
docs:check-links → docs link check passed; docs:check-scripts → docs script-ref check passed
Containers were not started locally (no Docker daemon on the review box).

Risk and rollout

Risk: Low. Local Compose only. Railway does not use this file, and neither does CI.
Rollback: Revert this PR.
Provider or production effects: None. This reduces accidental production effects.

Notes

Anyone who relied on docker compose up starting the worker must now add --profile worker, which needs connected-workload approval.

… URL A local `docker compose up` with production keys started a worker on the live ingestion queue, and the app build silently defaulted NEXT_PUBLIC_SUPABASE_URL to the production project. - Remove the production Supabase URL default; Compose now fails fast unless NEXT_PUBLIC_SUPABASE_URL is supplied. - Put the worker behind profiles: [worker] and drop the app's depends_on: worker. - Remove the obsolete version: "3.8" key. - Load .env.local via env_file with required: false. - Bind the worker's /health server on internal port 8080 and add a Compose healthcheck for it. - Update the README Compose section to match.

greptile-apps

BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

chatgpt-codex-connector · 2026-10-18T09:28:48Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T09:31:13.752200Z	`13bed43`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

codeant-ai · 2026-10-18T09:28:50Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	`13bed43`	Oct 18, 2026 · 09:28	09:35

codeant-ai · 2026-10-18T09:28:50Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

supabase · 2026-10-18T09:28:51Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

claude · 2026-10-18T09:29:01Z

Claude encountered an error after 2s —— View job

I'll analyze this and get back to you.

coderabbitai · 2026-10-18T09:29:08Z

Warning

Review limit reached

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 124 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: BigSimmo/PsychSift/.coderabbit.yaml
Review profile: CHILL
Plan: Team
Run ID: 442e3fd2-09a8-43bb-9a55-c311460c8659

📥 Commits

Reviewing files that changed from the base of the PR and between 675fec3 and a55c453.

📒 Files selected for processing: 2

README.md
docker-compose.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

qodo-code-review · 2026-10-18T09:29:18Z

PR Summary by Qodo

Make the Compose worker opt-in and require a Supabase URL

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Require an explicit Supabase URL in Compose to prevent builds targeting the production project by
 default.
• Start only the app by default; require the worker profile to enable ingestion.
• Add an internal worker healthcheck and document safe Compose startup.

Diagram

graph TD
  CLI["Compose command"] --> URL{"Supabase URL set?"} -->|set| APP["App service"]
  URL -->|missing| FAIL["Configuration error"]
  URL -->|set and worker profile| WORKER["Worker service"] --> HEALTH["Internal healthcheck"]

High-Level Assessment

The Compose profile directly addresses accidental worker startup without splitting the local stack into separate files. Requiring the URL at Compose interpolation also prevents the app's Dockerfile default from being used through this Compose path. A separate worker Compose file would add configuration duplication without a clear safety benefit.

Files changed (2) +52 / -18

Bug fix (1) +37 / -11

docker-compose.ymlGuard Compose startup and profile the ingestion worker +37/-11

Guard Compose startup and profile the ingestion worker

• Requires an explicit Supabase URL for the app build and runtime, removes the app's worker dependency, and places the worker behind an opt-in profile. Makes .env.local optional for both services, adds an internal worker healthcheck on port 8080, and removes the obsolete Compose version key.

docker-compose.yml

Documentation (1) +15 / -7

README.mdDocument app-only Compose startup and worker opt-in +15/-7

Document app-only Compose startup and worker opt-in

• Explains the required Supabase URL, why --env-file is needed for interpolation, and how to start the worker only after connected-workload approval. Documents the worker's internal health endpoint and shutdown command.

README.md

codeant-ai · 2026-10-18T09:29:23Z

🏁 CodeAnt Quality Gate Results

Commit: a55c4530
Scan Time: 2026-10-18 09:53:51 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating S: No issues

View Full Results

gitar-bot

Gitar has auto-approved this PR (configure)

qodo-code-review · 2026-10-18T09:30:55Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

No findings for this group

Resolved findings

1. ~~The documented shutdown command fails~~ ✓ Resolved

Description

The README’s docker compose --profile worker down command omits --env-file .env.local, although
the Compose file now requires NEXT_PUBLIC_SUPABASE_URL during interpolation. When a user starts
the stack with the documented --env-file .env.local up --build command and the URL exists only in
that file, the shutdown command fails before it can stop the containers.

Code

README.md[151]

+`http://localhost:3000`; stop the stack with `docker compose --profile worker down`.

Relevance

●●● Strong
Documented shutdown must preserve required Compose interpolation context; this is a clear,
deterministic README correction.
PR-#3522
PR-#3371

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The startup example supplies .env.local for interpolation, while the newly documented shutdown
example does not. The newly required URL expression is evaluated from Compose interpolation sources,
not the service’s env_file.

README.md[138-151]
docker-compose.yml[10-14]
docker-compose.yml[20-24]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The documented shutdown command does not supply the environment file used by the documented startup command, so required Compose interpolation can prevent shutdown.

## Fix Focus Areas
- README.md[149-151]

## Recommended Fix
Add `--env-file .env.local` to the documented `docker compose down` command so it works when the required Supabase URL is supplied only by that file.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

✅ Compliance rules (platform): 9 rules

✅ Cross-repo context — repo relationships

✅ REVIEW.md

Review mode: Auto: 🧠 Deep: Dense behavioral changes span hooks, shell guards, test runners, and configuration.

Tip of the day

💡 Did you know, you can move or hide resolved findings to focus on what still needs action

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit a55c453 🧠 Deep

Results up to commit 13bed43 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

No findings for this group

Resolved findings

1. ~~The documented shutdown command fails~~ ✓ Resolved

Description

The README’s docker compose --profile worker down command omits --env-file .env.local, although
the Compose file now requires NEXT_PUBLIC_SUPABASE_URL during interpolation. When a user starts
the stack with the documented --env-file .env.local up --build command and the URL exists only in
that file, the shutdown command fails before it can stop the containers.

Code

README.md[151]

+`http://localhost:3000`; stop the stack with `docker compose --profile worker down`.

Relevance

●●● Strong
Documented shutdown must preserve required Compose interpolation context; this is a clear,
deterministic README correction.
PR-#3522
PR-#3371

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The startup example supplies .env.local for interpolation, while the newly documented shutdown
example does not. The newly required URL expression is evaluated from Compose interpolation sources,
not the service’s env_file.

README.md[138-151]
docker-compose.yml[10-14]
docker-compose.yml[20-24]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The documented shutdown command does not supply the environment file used by the documented startup command, so required Compose interpolation can prevent shutdown.

## Fix Focus Areas
- README.md[149-151]

## Recommended Fix
Add `--env-file .env.local` to the documented `docker compose down` command so it works when the required Supabase URL is supplied only by that file.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Results up to commit b8220df 🚀 Fast

No changes from previous review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13bed43642

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

qodo-code-review · 2026-10-18T09:31:25Z

Qodo Fixer

✅ Committed (1) · ☑ Fixed (1)

Commits pushed directly to this PR — no separate fix PR opened.

Process — 1 fixed

☑ Fixed: The documented shutdown command fails

gitar-bot

Gitar has auto-approved this PR (configure)

8080 is Medications' API port, so sibling-repo port-isolation audits flagged the Compose worker health port as a collision.

…com/BigSimmo/PsychSift into fix/compose-worker-profile-20261018

…omment

gitar-bot

Gitar has auto-approved this PR (configure)

qodo-code-review · 2026-10-18T09:35:00Z

Code review by qodo was updated up to the latest commit b8220df

codeant-ai · 2026-10-18T09:35:29Z

CodeAnt Nitpicks

1 code suggestion

1. /health runs a five-second Supabase probe followed by a Python check that can also take five seconds, so successful combined checks can exceed this timeout and fail.

Possible bug · docker-compose.yml:90

codeant-ai · 2026-10-18T09:35:55Z

CodeAnt PR Risk: Medium Risk

The PR needs attention before merging: Compose passes the Supabase URL but no project metadata, which may leave staging browser authentication disabled.

Assessed commit: b8220df0446c

… example - Pass NEXT_PUBLIC_SUPABASE_STAGING_PROJECT_REF/NAME build args so the browser project guard accepts an explicitly configured staging URL. - Use --env-file .env.local in the header's worker startup example.

…ofile-20261018

gitar-bot

Gitar has auto-approved this PR (configure)

gitar-bot · 2026-10-18T09:51:01Z

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Making the ingestion worker opt-in and requiring an explicit Supabase URL changes Compose startup behavior; misconfiguration could still target an unintended project.

Makes the worker opt-in via a Compose profile and removes the production Supabase URL default so docker compose up starts only the app and fails fast without an explicit NEXT_PUBLIC_SUPABASE_URL. The README stop command now passes --env-file .env.local, addressing the finding that down also needed the URL. No issues found.

✅ 1 closed

✅ Bug: README stop command fails: down also needs NEXT_PUBLIC_SUPABASE_URL

📄 README.md:151 📄 docker-compose.yml:23 📄 docker-compose.yml:36
Compose interpolates the whole file for every subcommand, down included. The app's ${NEXT_PUBLIC_SUPABASE_URL:?...} (docker-compose.yml:23,36) therefore aborts docker compose --profile worker down with required variable NEXT_PUBLIC_SUPABASE_URL is missing a value whenever the URL was only supplied through --env-file .env.local, which is the workflow the README recommends. Someone following the README can start the stack but cannot stop it with the documented command, and that includes a worker claiming jobs from the live queue. Add --env-file .env.local to the documented down command, here and in the compose header comment.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Approved

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

Important

Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

qodo-code-review · 2026-10-18T09:51:51Z

Code review by qodo was updated up to the latest commit a55c453

BigSimmo enabled auto-merge (squash) October 18, 2026 09:28

greptile-apps Bot reviewed Oct 18, 2026

View reviewed changes

codeant-ai Bot added the size:M This PR changes 30-99 lines, ignoring generated files label Oct 18, 2026

qodo-code-review Bot added the 🕐 10-20 Minutes label Oct 18, 2026

gitar-bot Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread README.md Resolved

gitar-bot Bot previously approved these changes Oct 18, 2026

View reviewed changes

BigSimmo mentioned this pull request Oct 18, 2026

fix(docker): worker HEALTHCHECK, align docling lab digest, lab pip cache #3643

Merged

qodo-code-review Bot added the 🟠 Medium blast radius label Oct 18, 2026

qodo-code-review Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread README.md Resolved

chatgpt-codex-connector Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread README.md Resolved

fix: Pass the environment file when stopping

00ff64e

qodo-code-review Bot dismissed gitar-bot[bot]’s stale review via 00ff64e October 18, 2026 09:31

gitar-bot Bot previously approved these changes Oct 18, 2026

View reviewed changes

BigSimmo added 3 commits October 18, 2026 17:33

fix(compose): use internal port 3901 for the worker health server

d23153d

8080 is Medications' API port, so sibling-repo port-isolation audits flagged the Compose worker health port as a collision.

Merge branch 'fix/compose-worker-profile-20261018' of https://github.…

e34673e

…com/BigSimmo/PsychSift into fix/compose-worker-profile-20261018

docs(compose): drop the literal colliding port from the health-port c…

b8220df

…omment

BigSimmo dismissed gitar-bot[bot]’s stale review via b8220df October 18, 2026 09:33

gitar-bot Bot previously approved these changes Oct 18, 2026

View reviewed changes

codeant-ai Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread README.md Resolved

Comment thread docker-compose.yml Resolved

BigSimmo added 2 commits October 18, 2026 17:50

Merge remote-tracking branch 'origin/main' into fix/compose-worker-pr…

a55c453

…ofile-20261018

BigSimmo dismissed gitar-bot[bot]’s stale review via a55c453 October 18, 2026 09:50

gitar-bot Bot approved these changes Oct 18, 2026

View reviewed changes

qodo-code-review Bot added 🔴 Large blast radius and removed 🟠 Medium blast radius labels Oct 18, 2026

BigSimmo disabled auto-merge October 18, 2026 09:54

BigSimmo enabled auto-merge October 18, 2026 09:54

BigSimmo merged commit 12e78b5 into main Oct 18, 2026
40 checks passed

BigSimmo deleted the fix/compose-worker-profile-20261018 branch October 18, 2026 10:02

Conversation

BigSimmo commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Risk and rollout

Notes

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

codeant-ai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-ai Bot commented Oct 18, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

supabase Bot commented Oct 18, 2026

Uh oh!

claude Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

qodo-code-review Bot commented Oct 18, 2026

PR Summary by Qodo

Uh oh!

codeant-ai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🏁 CodeAnt Quality Gate Results

✅ Overall Status: PASSED

Quality Gate Details

Uh oh!

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

qodo-code-review Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Resolved findings

Resolved findings

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

qodo-code-review Bot commented Oct 18, 2026

Qodo Fixer

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

qodo-code-review Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Uh oh!

codeant-ai Bot commented Oct 18, 2026

CodeAnt Nitpicks

1. /health runs a five-second Supabase probe followed by a Python check that can also take five seconds, so successful combined checks can exceed this timeout and fail.

Uh oh!

codeant-ai Bot commented Oct 18, 2026

CodeAnt PR Risk: Medium Risk

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

gitar-bot Bot commented Oct 18, 2026

BigSimmo commented Oct 18, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 18, 2026 •

edited

Loading

codeant-ai Bot commented Oct 18, 2026 •

edited

Loading

claude Bot commented Oct 18, 2026 •

edited

Loading

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

codeant-ai Bot commented Oct 18, 2026 •

edited

Loading

qodo-code-review Bot commented Oct 18, 2026 •

edited

Loading