From fdd891ce5161a1e31e17bd39d1c2f66828921fe3 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 22 Sep 2026 13:21:16 -0400
Subject: [PATCH] fix(cd): force DEV_AUTH_BYPASS off for the migrate task

---
 .github/workflows/deploy-api.yaml  | 2 +-
 scripts/test-terraform-dev-only.py | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-api.yaml b/.github/workflows/deploy-api.yaml
index 7ae8400..dcff899 100644
--- a/.github/workflows/deploy-api.yaml
+++ b/.github/workflows/deploy-api.yaml
@@ -204,7 +204,7 @@ jobs:
             --task-definition "${FAMILY}:${REV}" \
             --launch-type FARGATE \
             --network-configuration "awsvpcConfiguration={subnets=[${SUBNETS}],securityGroups=[${SGS}],assignPublicIp=ENABLED}" \
-            --overrides "{\"containerOverrides\":[{\"name\":\"${CONTAINER}\",\"command\":[\"node\",\"packages/api/dist/db/migrate.js\"]}]}" \
+            --overrides "{\"containerOverrides\":[{\"name\":\"${CONTAINER}\",\"command\":[\"node\",\"packages/api/dist/db/migrate.js\"],\"environment\":[{\"name\":\"DEV_AUTH_BYPASS\",\"value\":\"false\"}]}]}" \
             --query 'tasks[0].taskArn' --output text)"
           aws ecs wait tasks-stopped --cluster "${CLUSTER}" --tasks "${TASK_ARN}"
           EXIT="$(aws ecs describe-tasks --cluster "${CLUSTER}" --tasks "${TASK_ARN}" \
diff --git a/scripts/test-terraform-dev-only.py b/scripts/test-terraform-dev-only.py
index e7ab362..edf0c59 100755
--- a/scripts/test-terraform-dev-only.py
+++ b/scripts/test-terraform-dev-only.py
@@ -61,6 +61,8 @@ def test_deploy_workflows_are_dev_only():
     assert "GIT_SHA" in api
     assert "verify-api-health.sh" in api
     assert "packages/api/dist/db/migrate.js" in api
+    assert "DEV_AUTH_BYPASS" in api
+    assert '\\"value\\":\\"false\\"' in api
 
 
 if __name__ == "__main__":