Harden production deployment workflow

src/payload.config.ts

@@ -44,6 +44,15 @@ const dirname = path.dirname(filename)
 const shouldPushSchema =
   process.env.PAYLOAD_DB_PUSH === 'true' ||
   (process.env.NODE_ENV !== 'production' && process.env.PAYLOAD_DB_PUSH !== 'false')
+const shouldRunProdMigrationsOnStart = process.env.PAYLOAD_RUN_MIGRATIONS_ON_START === 'true'
+const payloadSecret = process.env.PAYLOAD_SECRET
+
+if (
+  process.env.NODE_ENV === 'production' &&
+  (!payloadSecret || payloadSecret === 'change-me' || payloadSecret === 'replace-me-with-a-long-random-string')
+) {
+  throw new Error('PAYLOAD_SECRET must be set to a strong production value before starting Payload.')
+}
 
 export default buildConfig({
   admin: {
@@ -108,7 +117,7 @@ export default buildConfig({
     defaultLocale: 'en',
     fallback: false,
   },
-  secret: process.env.PAYLOAD_SECRET ?? 'change-me',
+  secret: payloadSecret ?? 'development-payload-secret',
   typescript: {
     outputFile: path.resolve(dirname, 'payload-types.ts'),
   },
@@ -118,7 +127,7 @@ export default buildConfig({
     },
     migrationDir: path.resolve(dirname, 'migrations'),
     push: shouldPushSchema,
-    prodMigrations: migrations,
+    prodMigrations: shouldRunProdMigrationsOnStart ? migrations : undefined,
   }),
   upload: {
     limits: {