Skip to content
POVLIB logo Gamesense

Showrunner

Showrunner is the control surface for demo processing.

Environment isolation

Section titled “Environment isolation”

Production Showrunner is the Vercel production deployment from demo-pipeline master and uses the production Cloud Run workers:

  • demo-downloader
  • analyst

The dev branch uses a Vercel preview deployment with staging resources:

  • Cloud Run: demo-downloader-dev, analyst-dev
  • R2 bucket: flashback-demo-json-files-dev
  • Supabase: dev/staging project credentials
  • NEXT_PUBLIC_APP_ENV=staging

Showrunner contains server-side runtime safety guards in showrunner/lib/runtime-safety.ts:

  • non-production deployments refuse to call production worker URLs
  • production deployments refuse to call *-dev worker URLs
  • non-production deployments refuse R2_BUCKET=flashback-demo-json-files
  • production deployments refuse R2_BUCKET=flashback-demo-json-files-dev
  • optional exact Supabase URL guardrails can be enabled with PRODUCTION_SUPABASE_URL and STAGING_SUPABASE_URL
  • staging cron is disabled unless ENABLE_STAGING_CRON=true

A visible STAGING badge is rendered in Showrunner previews so operators can tell they are not in production.

Vercel env targeting

Section titled “Vercel env targeting”

The showrunner Vercel project is connected to grindhub/demo-pipeline with production branch master.

Current staging values are branch-scoped to the dev preview branch. Generic PR previews remain fail-closed unless they receive staging-safe env values.

Important env vars for staging previews:

  • NEXT_PUBLIC_APP_ENV=staging
  • NEXT_PUBLIC_SUPABASE_URL / NEXT_PUBLIC_SUPABASE_ANON_KEY for dev Supabase
  • SUPABASE_SERVICE_ROLE_KEY for dev Supabase
  • DATABASE_URL for dev Supabase
  • R2_BUCKET=flashback-demo-json-files-dev
  • R2_ENDPOINT_URL, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY for staging R2 credentials
  • DEMO_DOWNLOADER_URL=https://demo-downloader-dev-mgrcncsvrq-ew.a.run.app
  • ANALYST_URL=https://analyst-dev-mgrcncsvrq-ew.a.run.app
  • staging-only WEBHOOK_SECRET, SHOWRUNNER_API_SECRET, and CRON_SECRET

Cloud Run staging services

Section titled “Cloud Run staging services”

The staging services are in GCP project povlib, region europe-west1:

  • demo-downloader-dev — lower max instances than production
  • analyst-dev — lower max instances than production

They use GCP Secret Manager *_DEV secrets and APP_ENV=staging. Public invocation is enabled to match production, but mutation endpoints must be protected by the staging webhook secret.

Operating guidance

Section titled “Operating guidance”
  • Do not use a UI environment switch as the primary isolation boundary.
  • Do not assign production Supabase/R2/worker credentials to preview deployments.
  • Keep Vercel cron production-only by default.
  • If a preview deployment shows a runtime-safety error, fix the env targeting instead of bypassing the guard.