Repository navigation
fix(trigger): keep secret text out of env sync errors and refuse an unknown sync target - #9672
Merged
Merged
Conversation
…nknown sync target A malformed env-vars secret failed with the JSON parser's message, which quotes the text around the fault, and the Trigger.dev deploy prints that error to a public CI log; the error now names only the failure. TRIGGER_ENV_SYNC_TARGETS was split on commas without trimming or validation, so a typo or a space silently kept an environment on its old configuration; it is now parsed by parseTriggerEnvSyncTargets, which trims entries and refuses a name with no mapped secret (by own key, so prototype names cannot pass), and the deploy logs which path it took. Comments now say the CLI applies synced variables when it uploads the version and that the sync never deletes, describe the retry as every failed request, and point the worker marker at TRIGGER_CONSTANT_VARS.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
 [Medium impact] The PR appears safe to merge; no new actionable issues remain. SummaryThe PR keeps secret text out of JSON errors and rejects malformed
Reviews (2) · Last reviewed commit: "fix(trigger): accept only the exact sync..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…lows match The workflows grant the secret-read credentials by matching TRIGGER_ENV_SYNC_TARGETS as an exact comma list, so a trimmed parser could accept a padded entry the credential step skipped and fail inside the sync instead. The parser now refuses a padded, empty, or unknown entry with a message naming the expected format.
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-ups to #9632 (Trigger.dev env sync from the app's Secrets Manager secret), from a final review of the release branch.
TRIGGER_ENV_SYNC_TARGETSwas split on commas with no validation, soStagingor a typo silently kept the environment on the old path.parseTriggerEnvSyncTargets(next toAPP_ENV_SECRET_IDS) accepts only the exact comma list the deploy workflows' credential checks match, and refuses a padded, empty, or unknown entry (checked by own key, soconstructorcannot pass); the deploy exits on it (syncEnvVarsswallows throws) and logs which path it took.resolveTriggerEnvFromAppSecretuses the same own-key lookup.fetchRuntimeSecretsretries every failed request (not only transient ones); the worker-marker comments point atTRIGGER_CONSTANT_VARS;FUNCTION_EXECUTION_ENVnotes it applies only outside the sync list.Type of Change
Testing
packages/runtime-secrets:keeps the secret text out of a malformed-JSON error(red on the old code: the message contained the value);parseTriggerEnvSyncTargetsreads the exact list, treats an unset gate as none, and refuses padded, empty, and unknown entries (red with trimming restored, or withininstead of an own-key check). 13/13.packages/runtime-secretsandapps/sim; lint and type-check (pre-push hooks); remaining audits in CIChecklist
test-auditauthoring gate)