fix(docker): make the preview policy fail closed

[FelixTJDietrich]

Description

#1457 moved the preview policy into a mounted sanitize.sql. On this Coolify version that mount does not work, and it failed in the worst possible way — silently, with a success marker.

Coolify materialises a relative bind mount as an empty managed directory, so /preview/sanitize.sql was a directory inside the container:

• test -s <directory> passes — a directory reports a non-zero size;
• psql < <directory> reads nothing and exits 0.

So the seeder printed "Applying the preview policy", wrote .hephaestus-preview-seeded, and started the application server on a clone where nothing had been applied. Observed on the first preview seeded after #1457 merged: three workspaces with practice-review triggers enabled, the PRACTICE_REVIEW binding enabled, the source instance's OAuth apps, and its JWT signing key — with the agent runtime on and the preview attached to shared NATS. That is precisely the state the policy exists to prevent.

What changes

The policy moves back inline, which is the form this Coolify version actually runs. The .sql file was better to read; it does not survive contact with the deployment, and correctness wins.

The marker is now written only against the database's own answer. After applying the policy the seeder counts what is still live — enabled triggers, enabled PRACTICE_REVIEW bindings, enabled sweep schedules, queued or running agent and sync jobs, and any surviving login_provider, jwt_signing_key or issued_jwt row — and fails the deployment unless that total is zero.

That second part is the real fix. The first failure was a mount; the next one will be something else, and a seeder that reports success without checking will hide that one too. Fail-closed now means "the database says so", not "the command exited 0".

How to test

Coolify parses the Compose file from main, so this is not exercised by its own preview (documented in the README). Verified by hand on the staging host against a real clone:

• the fault: psql -v ON_ERROR_STOP=1 -d hephaestus < <a directory> → no statements, exit 0;
• the guard: with the policy applied the count query returns 0 and seeding proceeds; with any trigger, binding or provider row restored it returns non-zero and the seeder exits 1 before the marker is written.

The heredoc indentation is byte-identical to the form that has been running since #1455, and docker compose -f docker/preview/compose.app.yaml config renders.

After this merges, the next preview created re-seeds through this path; the affected preview has already been re-sanitized by hand and now holds its own login apps and signing key.

Checklist

• My changeset summary reads as an operator/user-facing note (it becomes the changelog entry) — see .changeset/README.md
• If the operator must act on this change (new required env var, manual migration step), the changeset summary says how (**Operators:** …) and MIGRATION.md is updated

No new variable and no operator action.

[coderabbitai]

Warning

Review limit reached

@FelixTJDietrich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eeb48ed3-8566-4508-8c88-25fb4e635f6f

📥 Commits

Reviewing files that changed from the base of the PR and between 506b379 and 7431d04.

📒 Files selected for processing (4)

• .changeset/preview-policy-fails-closed.md
• docker/preview/README.md
• docker/preview/compose.app.yaml
• docker/preview/sanitize.sql

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)