chore(supabase): use publishable key naming

[cameroncuster]

Summary

• rename PUBLIC_SUPABASE_ANON_KEY to PUBLIC_SUPABASE_PUBLISHABLE_KEY across the app, server routes, test harnesses, and documentation
• configure live CI to read both the Supabase URL and publishable key from repository Actions secrets
• remove legacy anon-key terminology while preserving the existing client-safe public-key behavior

Configuration

GitHub repository Actions secrets are configured as:

• PUBLIC_SUPABASE_URL
• PUBLIC_SUPABASE_PUBLISHABLE_KEY

Vercel preview and production environments must expose the same two names before this merges.

Testing

• Prettier, ESLint, and Svelte checks passed
• 399 unit tests passed with coverage thresholds
• production build and performance budgets passed
• complete mocked desktop and mobile Playwright projects passed
• verified no legacy PUBLIC_SUPABASE_ANON_KEY references remain

The PR CI run should execute—rather than skip—both live read-only Supabase smoke projects.

---

Pull Request opened by Augment Code | View session

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gitgud	Ready	Preview, Comment	Jul 26, 2026 4:33pm

[cameroncuster]

^{PR Risk Analyzer Agent🛡️}

👀 Human Input Needed
A pair-review briefing is ready for you.

→ Pair Review Briefing

[cameroncuster]

^{Deep Code Review Agent🐛}

Review completed with 0 suggestions.

[cameroncuster]

^{Verifier 🛰️}

🛰️ Verifier Report

TL;DR: Built and served the renamed-key head end-to-end and drove the full mocked desktop + mobile browser suite against a live mock Supabase backend — the app builds, serves, and renders real data through PUBLIC_SUPABASE_PUBLISHABLE_KEY.

🔍 Walkthrough

• Production build resolves the renamed public env var and ships it to the client — the build inlined the injected key value into the emitted browser bundle (on mainline the code imports …_ANON_KEY; on this head it imports …_PUBLISHABLE_KEY, and the build keys off the new name).

  build succeeds; new key value is inlined into the client bundle; zero ANON_KEY residue in output

  $ PUBLIC_SUPABASE_URL=http://localhost PUBLIC_SUPABASE_PUBLISHABLE_KEY=mock-publishable-key vite build
  ✓ built in 3.21s
  
  # emitted client output contains the injected value:
  $ grep -rho "mock-publishable-key" .svelte-kit/output/client/ | wc -l
  1
  # and no stale anon-key string leaked into the build:
  $ grep -rn "SUPABASE_ANON_KEY" .svelte-kit/output/ | wc -l
  0
  

  SvelteKit's $env/static/public validates referenced vars at build time, so a leftover PUBLIC_SUPABASE_ANON_KEY import would have failed here.

• Full mocked Playwright suite (desktop + mobile) is green against a live mock Supabase → 207 passed, 7 skipped — the app renders, navigates, and reads/writes through the renamed key across every route and the submit/import flows.

  207 passed / 7 skipped — the 7 are the opt-in live-smoke suite, correctly gated on the renamed var

  $ pnpm exec playwright test
    7 skipped
    207 passed (1.8m)
  

  The 7 skips are e2e/live-smoke.spec.ts, gated behind SUPABASE_SMOKE=1 + real PUBLIC_SUPABASE_PUBLISHABLE_KEY (off by default, read-only — out of scope here).

• Home + leaderboard serve and render real fixture data through the renamed key in a real browser:
  

• No stale references remain and the pure-logic rung is covered by the diff's own suite — git grep PUBLIC_SUPABASE_ANON_KEY finds nothing tree-wide, and the 399 unit tests pass with the renamed $env mock.

  zero remaining ANON_KEY references; 399/399 unit tests pass

  $ git grep -n "PUBLIC_SUPABASE_ANON_KEY"
  (no matches)
  
  $ pnpm run test
  ℹ tests 399
  ℹ pass 399
  ℹ fail 0
  

📋 Scope

Under test: renames the client-safe public Supabase key from PUBLIC_SUPABASE_ANON_KEY to PUBLIC_SUPABASE_PUBLISHABLE_KEY across app code, the server authorization client, the codeforces user-solves route, the test/coverage harnesses, CI, and docs — value semantics unchanged.

Not tested:

• The CI workflow change (live-smoke gate now reads secrets.PUBLIC_SUPABASE_PUBLISHABLE_KEY, and PUBLIC_SUPABASE_URL moves from vars to secrets) — GitHub Actions config that needs the real repo secrets to execute; verified statically only, not runtime-observable from this runner. Confirm both secret names (PUBLIC_SUPABASE_URL, PUBLIC_SUPABASE_PUBLISHABLE_KEY) exist in repo Actions secrets, and that Vercel preview/prod expose the same two names, before merge.
• Opt-in live read-only Supabase smoke (SUPABASE_SMOKE=1) — off by default, out of scope.

📦 Artifacts · home.png · leaderboard.png

---

Don't like what you see? Add a verification skill so the next run tests this kind of change.

Want another run? Comment cosmos verify on this PR.

👍 / 👎 · View session