fix: remove hardcoded database credentials from prisma config

.github/workflows/ci.yaml

@@ -21,6 +21,8 @@ jobs:
   validate:
     name: Validate
     runs-on: ubuntu-latest
+    env:
+      DATABASE_URL: "postgresql://test:test@localhost:5432/dispatch_ci"
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/image.yaml

@@ -69,8 +69,8 @@ jobs:
           IMAGE="dispatch:prisma-cli-runtime"
           docker build -t "$IMAGE" .
           echo "Validating Prisma CLI in image: $IMAGE"
-          docker run --rm --entrypoint ./node_modules/.bin/prisma "$IMAGE" --version
-          docker run --rm --entrypoint ./node_modules/.bin/prisma "$IMAGE" validate
+          docker run --rm --env DATABASE_URL=postgresql://localhost:5432/dispatch --entrypoint ./node_modules/.bin/prisma "$IMAGE" --version
+          docker run --rm --env DATABASE_URL=postgresql://localhost:5432/dispatch --entrypoint ./node_modules/.bin/prisma "$IMAGE" validate
 
       - name: Run Trivy vulnerability scanner
         if: github.event_name != 'pull_request'

Dockerfile

@@ -16,6 +16,7 @@ COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates && rm -rf /var/lib/apt/lists/*
 RUN npx prisma generate
+ENV DATABASE_URL=postgresql://localhost:5432/dispatch
 RUN npm run build
 
 FROM base AS runner

prisma.config.ts

@@ -1,11 +1,16 @@
 import { defineConfig } from "prisma/config";
 
-const databaseUrl =
-  process.env.DATABASE_URL ?? "postgresql://dispatch:dispatch@localhost:5432/dispatch";
+const databaseUrl = process.env.DATABASE_URL;
+
+if (process.env.NODE_ENV === "production" && !databaseUrl) {
+  throw new Error(
+    "DATABASE_URL is not set. Please set the DATABASE_URL environment variable before starting the application.",
+  );
+}
 
 export default defineConfig({
   schema: "prisma/schema.prisma",
   datasource: {
-    url: databaseUrl,
+    url: databaseUrl ?? "postgresql://localhost:5432/dispatch",
   },
 });

src/lib/prisma.ts

@@ -3,10 +3,13 @@ import { PrismaPg } from "@prisma/adapter-pg";
 import { PrFixQueueClient } from "@/lib/pr-fix-queue";
 import { AgentWorkClient } from "@/lib/agent-work";
 
-const databaseUrl =
-  process.env.DATABASE_URL ?? "postgresql://dispatch:dispatch@localhost:5432/dispatch";
+if (process.env.NODE_ENV === "production" && !process.env.DATABASE_URL) {
+  throw new Error(
+    "DATABASE_URL is not set. Please set the DATABASE_URL environment variable before starting the application.",
+  );
+}
 
-const adapter = new PrismaPg(databaseUrl);
+const adapter = new PrismaPg(process.env.DATABASE_URL!);
 
 const globalForPrisma = globalThis as unknown as {
   prisma: PrismaClient | undefined;

vitest.setup.ts

@@ -1,6 +1,10 @@
 // Import @testing-library/jest-dom/vitest for custom matchers
 import "@testing-library/jest-dom/vitest";
 
+// Provide a dummy DATABASE_URL so prisma.ts module loads without throwing.
+// Tests that need real DB access mock/override as needed.
+process.env.DATABASE_URL ??= "postgresql://test:test@localhost:5432/dispatch_test";
+
 // Patch React.act for React 19 + @testing-library/react v16 compat.
 // React 19 removed React.act, but older react-dom/test-utils still calls it.
 const React = require("react");