feat: support isSecret in syncEnvVars by isshaddad · Pull Request #4203 · triggerdotdev/trigger.dev

isshaddad · 2026-07-09T13:40:19Z

What

Adds per-variable secret support to the syncEnvVars build extension. Return { name, value, isSecret: true } and the variable is stored as a secret (redacted in the dashboard, value non-revealable), just like a manually created secret env var. Secret and non-secret variables can be mixed in one callback.

syncEnvVars(async () => [
  { name: "PUBLIC_API_URL", value: "https://api.example.com" },
  { name: "DATABASE_URL", value: "postgres://...", isSecret: true },
]);

How

Env vars flow through the build pipeline as a flat name→value map, and the import API's isSecret is per-call. So secret vars are carried through the layer + manifest in parallel secretEnv / secretParentEnv maps, and at deploy time they go up in a second importEnvVars call with isSecret: true (the plain vars in the first call). The record form ({ KEY: "value" }) is unchanged and stays non-secret.

Commits

feat(core): carry secret env vars through the build layer + manifest schema
feat(build): partition isSecret vars in syncEnvVars
feat(cli): merge secret layers and import them with isSecret: true at deploy
test(build): cover the partitioning + document isSecret

Testing

vitest covers the partitioning (secret/non-secret × child/parent) and that the record form stays non-secret.
Verified against a local webapp that the deploy's import contract stores the secret var redacted (isSecret: true) and the plain var visible.

Closes TRI-11099

changeset-bot · 2026-07-09T13:40:24Z

🦋 Changeset detected

Latest commit: e084f22

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
@trigger.dev/build	Patch
trigger.dev	Patch
@trigger.dev/python	Patch
@internal/dashboard-agent	Patch
@trigger.dev/core	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch
@internal/zod-worker	Patch
@internal/sdk-compat-tests	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-07-09T13:40:52Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: e16e0d21-c28b-40be-bd96-5e1983460d9d

📥 Commits

Reviewing files that changed from the base of the PR and between d196561 and e084f22.

📒 Files selected for processing (1)

packages/cli-v3/src/commands/workers/build.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/cli-v3/src/commands/workers/build.ts

📜 Recent review details

⏰ Context from checks skipped due to timeout. (32)

GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 10)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 10)
GitHub Check: internal / 🧪 Unit Tests: Internal (5, 12)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 10)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 10)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 10)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 10)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 10)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 10)
GitHub Check: internal / 🧪 Unit Tests: Internal (10, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (11, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (8, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (7, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (1, 12)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 10)
GitHub Check: internal / 🧪 Unit Tests: Internal (2, 12)
GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 10)
GitHub Check: internal / 🧪 Unit Tests: Internal (9, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (3, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (12, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (4, 12)
GitHub Check: internal / 🧪 Unit Tests: Internal (6, 12)
GitHub Check: sdk-compat / Node.js 24.18 (warp-ubuntu-latest-x64-4x)
GitHub Check: sdk-compat / Node.js 26.4 (warp-ubuntu-latest-x64-4x)
GitHub Check: packages / 🧪 Unit Tests: Packages (3, 3)
GitHub Check: sdk-compat / Cloudflare Workers
GitHub Check: typecheck / typecheck
GitHub Check: packages / 🧪 Unit Tests: Packages (1, 3)
GitHub Check: e2e / 🧪 CLI v3 tests (warp-windows-latest-x64-4x - pnpm)
GitHub Check: packages / 🧪 Unit Tests: Packages (2, 3)
GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp
GitHub Check: Build and publish previews

Walkthrough

This PR adds support for marking environment variables synced via syncEnvVars as secrets. Array-form entries accept isSecret, secret values are emitted through build layers and manifests, and CLI deployment imports secret and non-secret variables separately. Tests, Vitest configuration, documentation, and a patch changeset were added.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: adding isSecret support to syncEnvVars.
Description check	✅ Passed	It includes the change summary, implementation details, commits, and testing, but omits the template's issue link and screenshot/checklist sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/sync-env-vars-is-secret-tri-11099

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-07-09T14:11:18Z

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@e084f22

trigger.dev

npm i https://pkg.pr.new/trigger.dev@e084f22

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@e084f22

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@e084f22

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@e084f22

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@e084f22

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@e084f22

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@e084f22

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@e084f22

commit: e084f22

## Summary 2 new features, 11 improvements, 5 bug fixes. ## Breaking changes - Trigger.dev v3 is no longer supported. For self-hosted deployments, 4.5.0 is the last version we officially support for running v3; stay on 4.5.0 or upgrade to v4. v3 triggers, batch triggers, reschedules, and deploys now return a clear upgrade message instead of running. ([#4236](#4236)) ## Improvements - You can now mark environment variables synced via the `syncEnvVars` build extension as secrets. Return `{ name, value, isSecret: true }` from your callback and those variables are stored redacted in the dashboard, just like manually created secret env vars. ([#4203](#4203)) - Remove the legacy `--mcp` and `--mcp-port` options from the `dev` command. Run the dedicated `trigger mcp` command to start the Trigger.dev MCP server. ([#4246](#4246)) - Removed the unused `ResourceMonitor` export from `@trigger.dev/core/v3/serverOnly`. It was a server-side logging helper with no remaining consumers. ([#4244](#4244)) - Removed the unused `@trigger.dev/core/v3/zodNamespace` export and the legacy v3 socket message schemas. These were only used by the now-retired v3 engine and have no v4 consumers. ([#4236](#4236)) ## Bug fixes - Fix a `chat.agent` message-loss race where sending a message right after an action (such as an undo) could drop the follow-up's response from the UI until a refresh. ([#4234](#4234)) ## Server changes These changes affect the self-hosted Docker image and Trigger.dev Cloud: - Added `EVENT_REPOSITORY_POSTGRES_WRITES_DISABLED` to skip all PostgreSQL task-event writes for deployments that store task events in ClickHouse. Leave it off unless `EVENT_REPOSITORY_DEFAULT_STORE` is `clickhouse_v2`, otherwise task events are lost. ([#4242](#4242)) - Promo credits: a /promo signup landing page, redeeming a promo code when a new org selects a plan, and showing remaining credits on the usage page. ([#4138](#4138)) - Speed up retrieving a background worker by version. The endpoint no longer runs a slow lookup that scanned the full task table for large deployments; it now reuses data it already loads, so the response is the same but returns much faster. ([#4245](#4245)) - Clearer login error when an email address is blocked by the WHITELISTED_EMAILS setting: the message now explains the address isn't allowed on this instance instead of the ambiguous "This email is unauthorized". ([#4220](#4220)) - Make the native build server the default in project build settings. It's now opt-out, stored as a new `disableNativeBuildServer` key. Also clarifies in the UI that build settings apply to GitHub-triggered and native build server deployments. ([#3980](#3980)) - Optionally process high-volume telemetry ingestion in parallel for higher throughput under heavy load by setting `OTEL_TRANSFORM_WORKER_POOL_ENABLED=1`. Off by default. ([#4232](#4232)) - Add a `REALTIME_BACKEND_DEFAULT` env var to choose the default realtime backend (`electric`, `native`, or `shadow`) for environments whose org has no per-org override. Defaults to `electric`, so existing behavior is unchanged. ([#4231](#4231)) - Clarified on the Regions page that a region only affects where your runs execute, not where your data is stored. This shows as a tooltip on the Location column and in the confirmation dialog when you change your default region. ([#4226](#4226)) - Improved the reliability of how run data is read and written. ([#4237](#4237)) - Fixed stale login errors: an error from a previous login attempt (for example a rejected email address) no longer keeps reappearing on the login page and no longer makes later, successful attempts look like they failed. ([#4220](#4220)) - The Errors page now shows better details for each error. Errors that don't carry a message — such as errors thrown without a message, or values thrown that aren't `Error` objects — get a meaningful title instead of all reading "Unknown error", and are grouped by their name (or value) rather than collapsed into a single group. The error type now shows the actual error name, and stack traces now appear where previously they were missing. ([#4225](#4225)) - Return a clear client error when SSO form submissions use an unsupported content type ([#4238](#4238)) - Query page: extracting fields from a run's output with JSON functions (such as JSONExtractString or JSONExtractInt) no longer fails with an "illegal type: JSON" error. ([#4221](#4221)) <details> <summary>Raw changeset output</summary> # Releases ## @trigger.dev/build@4.5.4 ### Patch Changes - You can now mark environment variables synced via the `syncEnvVars` build extension as secrets. Return `{ name, value, isSecret: true }` from your callback and those variables are stored redacted in the dashboard, just like manually created secret env vars. ([#4203](#4203)) - Updated dependencies: - `@trigger.dev/core@4.5.4` ## trigger.dev@4.5.4 ### Patch Changes - Remove the legacy `--mcp` and `--mcp-port` options from the `dev` command. Run the dedicated `trigger mcp` command to start the Trigger.dev MCP server. ([#4246](#4246)) - Updated dependencies: - `@trigger.dev/core@4.5.4` - `@trigger.dev/build@4.5.4` - `@trigger.dev/schema-to-json@4.5.4` ## @trigger.dev/core@4.5.4 ### Patch Changes - Removed the unused `ResourceMonitor` export from `@trigger.dev/core/v3/serverOnly`. It was a server-side logging helper with no remaining consumers. ([#4244](#4244)) - Removed the unused `@trigger.dev/core/v3/zodNamespace` export and the legacy v3 socket message schemas. These were only used by the now-retired v3 engine and have no v4 consumers. ([#4236](#4236)) ## @trigger.dev/python@4.5.4 ### Patch Changes - Updated dependencies: - `@trigger.dev/sdk@4.5.4` - `@trigger.dev/core@4.5.4` - `@trigger.dev/build@4.5.4` ## @trigger.dev/react-hooks@4.5.4 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.5.4` ## @trigger.dev/redis-worker@4.5.4 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.5.4` ## @trigger.dev/rsc@4.5.4 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.5.4` ## @trigger.dev/schema-to-json@4.5.4 ### Patch Changes - Updated dependencies: - `@trigger.dev/core@4.5.4` ## @trigger.dev/sdk@4.5.4 ### Patch Changes - Fix a `chat.agent` message-loss race where sending a message right after an action (such as an undo) could drop the follow-up's response from the UI until a refresh. ([#4234](#4234)) - Updated dependencies: - `@trigger.dev/core@4.5.4` </details> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

isshaddad added 5 commits July 8, 2026 13:49

feat(core): carry secret env vars through build layer and manifest

fcee52f

feat(build): support isSecret in syncEnvVars

d756d07

feat(cli): import synced secret env vars as secrets

dc5511f

test(build): cover syncEnvVars isSecret partitioning + docs

2ce39b2

Merge branch 'main' into feat/sync-env-vars-is-secret-tri-11099

7125eda

This comment was marked as resolved.

Sign in to view

isshaddad added 2 commits July 9, 2026 10:02

chore: fix formatting in deploy.ts

82f01f7

fix(cli): make syncEnvVarsWithServer no-op safe for empty input

4dec9f9

isshaddad marked this pull request as ready for review July 9, 2026 14:33

Merge branch 'main' into feat/sync-env-vars-is-secret-tri-11099

304d90c

isshaddad marked this pull request as draft July 9, 2026 14:33

This comment was marked as resolved.

Sign in to view

isshaddad and others added 2 commits July 9, 2026 10:48

fix(cli): sync secret env vars on the worker build path too

0633aae

Merge branch 'main' into feat/sync-env-vars-is-secret-tri-11099

19b39d3

isshaddad marked this pull request as ready for review July 9, 2026 23:09

ericallam requested changes Jul 10, 2026

View reviewed changes

Comment thread .changeset/sync-env-vars-is-secret.md Outdated

chore: scope syncEnvVars changeset to a build patch

d196561

This comment was marked as resolved.

Sign in to view

fix(cli): gate synced parent env vars on branch in worker build path

e084f22

isshaddad requested a review from ericallam July 10, 2026 13:56

ericallam approved these changes Jul 10, 2026

View reviewed changes

isshaddad merged commit 983bd03 into main Jul 10, 2026
58 checks passed

isshaddad deleted the feat/sync-env-vars-is-secret-tri-11099 branch July 10, 2026 15:03

github-actions Bot mentioned this pull request Jul 10, 2026

chore: release v4.5.4 #4228

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: support isSecret in syncEnvVars#4203

feat: support isSecret in syncEnvVars#4203
isshaddad merged 12 commits into
mainfrom
feat/sync-env-vars-is-secret-tri-11099

isshaddad commented Jul 9, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading

Reviews paused

❌ Failed checks (1 warning)

Uh oh!

This comment was marked as resolved.

Uh oh!

pkg-pr-new Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

isshaddad commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Commits

Testing

Uh oh!

changeset-bot Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

This comment was marked as resolved.

Uh oh!

pkg-pr-new Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

isshaddad commented Jul 9, 2026 •

edited

Loading

changeset-bot Bot commented Jul 9, 2026 •

edited

Loading

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 9, 2026 •

edited

Loading