CI could never have built the backend image
prisma generate fails with 'Cannot resolve environment variable: DATABASE_URL' when the CI image build never passes it as a build arg, even though generate never connects.
The safety net had a hole
The test, the audit log, the scanner, the CI run — covering less than I assumed it did.
While debugging the above I built the real prod stage from scratch and hit a pre-existing failure: prisma generate throwing Cannot resolve environment variable: DATABASE_URL. The CI workflow that builds this image never passes DATABASE_URL/DIRECT_URL as build args and never has.
prisma generate only reads the schema and never connects, but the config loader still requires the var to be present. So this step would fail in CI exactly as it did locally, every time.
Rather than routing real secrets through build args — which bakes credentials into image layer history, and images get scanned, pulled and cached in places you don't control — I put harmless placeholders in the builder stage, scoped to the generate step. A build-time var that only exists to satisfy a config loader should be a placeholder in the Dockerfile, not a CI secret. Also a reminder that "the workflow exists and looks reasonable" isn't "the workflow has succeeded recently."