From 843375d6ef6c40d90b6f62b1f2509258fd446829 Mon Sep 17 00:00:00 2001
From: Elliot Slusky <44592435+ElliotSlusky@users.noreply.github.com>
Date: Tue, 23 Jun 2026 16:32:13 -0700
Subject: [PATCH] Fix Supabase frontend build env for release builds (#588)

Follow-up to #587. Pass VITE_SUPABASE_ANON_KEY into the frontend builds of both release paths: the PyPI publish workflow (wheel-bundled frontend) and the desktop tauri-action build (npm run build:tauri -> vite build). Kept strict: a missing/empty secret fails the release by design rather than shipping a placeholder key. Requires the VITE_SUPABASE_ANON_KEY repo secret to be set for releases to succeed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/desktop.yml      | 4 ++++
 .github/workflows/pypi-publish.yml | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/desktop.yml b/.github/workflows/desktop.yml
index 27d8b7f1..7e4f862d 100644
--- a/.github/workflows/desktop.yml
+++ b/.github/workflows/desktop.yml
@@ -254,6 +254,10 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           TAURI_CONFIG: '{"version":"${{ steps.release-info.outputs.tauri_version }}","bundle":{"externalBin":["binaries/ollama"]}}'
+          # tauri-action runs beforeBuildCommand (npm run build:tauri -> vite
+          # build), which requires this at build time (#587). Strict for
+          # releases: a missing/empty secret fails the build by design.
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
         with:
           projectPath: frontend
           tauriScript: npx tauri
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
index 4cd1bcc7..cd1b7aa8 100644
--- a/.github/workflows/pypi-publish.yml
+++ b/.github/workflows/pypi-publish.yml
@@ -55,6 +55,8 @@ jobs:
           cache-dependency-path: frontend/package-lock.json
 
       - name: Build frontend and bundle into package
+        env:
+          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
         run: |
           set -euo pipefail
           cd frontend