Stop a missing sandbox token from failing the whole deploy

[Makisuo]

The production deploy of #819 failed at config load, before any resource was touched, so nothing deployed:

ConfigError: SchemaError(Expected string
  at ["SANDBOX_INTERNAL_SERVICE_TOKEN"])

requireSecretEntry in the sandbox Worker's props was meant to refuse a sandbox that would answer 401 to every call. That intent is right. The effect was wrong: it failed alchemy deploy for the entire stage on a secret nobody had provisioned yet, so every other Worker was blocked from updating too.

The decision moves up to the stack, where it can be made without failing. secretIsSet reports presence without reading the value, and the sandbox Worker is declared only when the stage runs one and the token is set. Without it the rest of the stage deploys normally, no sandbox is provisioned, and the api logs that the repository sandbox is unavailable — which it already did for exactly this case. The Worker's own props still require the token; that path is now unreachable while it is absent.

Setting SANDBOX_INTERNAL_SERVICE_TOKEN for prd and stg is what turns the feature on.

Verified: typecheck and lint clean, infra tests pass including two new cases pinning that secretIsSet treats blank as absent and never fails where requireSecretEntry does, and a dev-stage plan is unchanged.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes
  • Sandbox-enabled deployments now continue deploying the API and other services when the sandbox token is missing.
  • A warning is displayed when the sandbox is skipped due to a missing or blank token.
  • When the token is available, sandbox deployment continues to work as expected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d294e12e-60f7-47bb-a418-bd7feccbbe25

📥 Commits

Reviewing files that changed from the base of the PR and between c25dde0 and 1c216d6.

📒 Files selected for processing (3)

• alchemy.run.ts
• packages/infra/src/env.test.ts
• packages/infra/src/env.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The change adds a non-failing secret-presence helper and uses it to make sandbox deployment conditional on SANDBOX_INTERNAL_SERVICE_TOKEN.

Changes

Sandbox token gating

Layer / File(s)	Summary
Secret presence contract and tests packages/infra/src/env.ts, packages/infra/src/env.test.ts	secretIsSet returns whether a trimmed secret value exists without exposing the secret. Tests cover missing, blank, whitespace-only, and valid values.
Sandbox deployment gating alchemy.run.ts	Sandbox stages warn and skip MapleSandbox when the token is absent. They retain sandbox deployment when the token is present.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AlchemyRun
  participant secretIsSet
  participant MapleSandbox
  AlchemyRun->>secretIsSet: check SANDBOX_INTERNAL_SERVICE_TOKEN
  secretIsSet-->>AlchemyRun: return configured boolean
  alt token is configured
    AlchemyRun->>MapleSandbox: create sandbox
  else token is absent
    AlchemyRun-->>AlchemyRun: log warning and skip sandbox
  end

Loading

Merge Risk: ⚪ Minimal · up to 1c216

Missing or blank sandbox tokens now skip only sandbox creation while allowing other stage resources to deploy. The behavior is covered by tests and no merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely states the main change: a missing sandbox token no longer blocks the full deployment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sandbox-token-blocks-deploy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}