Hardcode env in workflow step

.github/workflows/to-docker-hub.yaml

@@ -34,6 +34,6 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           # Hardcoding the URL of meshdb into the image we build... There is probably
           # a better way to do this.
-          secrets: |
-            NEXT_PUBLIC_MESHDB_URL=https://db.grandsvc.mesh.nycmesh.net/
+          build-args: |
+            "MESHDB_URL=${{ secrets.MESHDB_URL }}"
 

Dockerfile

@@ -27,6 +27,12 @@ COPY . .
 # Uncomment the following line in case you want to disable telemetry during the build.
 ENV NEXT_TELEMETRY_DISABLED 1
 
+# PSA: This is publically readable in the docker registry. Not a problem, since
+# it's a public URL anyway, but definitely don't do this with actually sensitive
+# data like an API key.
+ARG MESHDB_URL 
+ENV NEXT_PUBLIC_MESHDB_URL=${MESHDB_URL}
+
 RUN yarn build
 
 # Production image, copy all the files and run next

app/api.ts

@@ -1,5 +1,11 @@
 import { z } from "zod";
 
+if (process.env.NEXT_PUBLIC_MESHDB_URL === undefined) {
+  throw new Error('Expected API url environment variable');
+}
+
+const API_BASE = new URL(process.env.NEXT_PUBLIC_MESHDB_URL as string);
+
 export const JoinFormInput = z.object({
   first_name: z.string(),
   last_name: z.string(),
@@ -92,8 +98,6 @@ const post = async <S extends z.Schema>(url: string, schema: S, input: unknown,
   return schema.parse(await res.json())
 }
 
-const API_BASE = new URL(process.env.NEXT_PUBLIC_MESHDB_URL as string)
-
 // TODO: Env var for api token
 export const submitJoinForm = (input: JoinFormInput) => post(`/api/v1/join/`, JoinFormResponse, JoinFormInput.parse(input))
 export const submitNNAssignForm = (input: NNAssignFormInput) => post(`/api/v1/nn-assign/`, NNAssignFormResponse, NNAssignFormInput.parse(input))