feat: support isSecret in syncEnvVars

[isshaddad]

What

Adds per-variable secret support to the syncEnvVars build extension. Return { name, value, isSecret: true } and the variable is stored as a secret (redacted in the dashboard, value non-revealable), just like a manually created secret env var. Secret and non-secret variables can be mixed in one callback.

syncEnvVars(async () => [
  { name: "PUBLIC_API_URL", value: "https://api.example.com" },
  { name: "DATABASE_URL", value: "postgres://...", isSecret: true },
]);

How

Env vars flow through the build pipeline as a flat name→value map, and the import API's isSecret is per-call. So secret vars are carried through the layer + manifest in parallel secretEnv / secretParentEnv maps, and at deploy time they go up in a second importEnvVars call with isSecret: true (the plain vars in the first call). The record form ({ KEY: "value" }) is unchanged and stays non-secret.

Commits

• feat(core): carry secret env vars through the build layer + manifest schema
• feat(build): partition isSecret vars in syncEnvVars
• feat(cli): merge secret layers and import them with isSecret: true at deploy
• test(build): cover the partitioning + document isSecret

Testing

• vitest covers the partitioning (secret/non-secret × child/parent) and that the record form stays non-secret.
• Verified against a local webapp that the deploy's import contract stores the secret var redacted (isSecret: true) and the plain var visible.

Closes TRI-11099

[changeset-bot]

🦋 Changeset detected

Latest commit: e084f22

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
@trigger.dev/build	Patch
trigger.dev	Patch
@trigger.dev/python	Patch
@internal/dashboard-agent	Patch
@trigger.dev/core	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch
@internal/zod-worker	Patch
@internal/sdk-compat-tests	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: e16e0d21-c28b-40be-bd96-5e1983460d9d

📥 Commits

Reviewing files that changed from the base of the PR and between d196561 and e084f22.

📒 Files selected for processing (1)

• packages/cli-v3/src/commands/workers/build.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/cli-v3/src/commands/workers/build.ts

📜 Recent review details

⏰ Context from checks skipped due to timeout. (32)

• GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 10)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 10)
• GitHub Check: internal / 🧪 Unit Tests: Internal (5, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 10)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 10)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 10)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 10)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 10)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 10)
• GitHub Check: internal / 🧪 Unit Tests: Internal (10, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (11, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (8, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (7, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (1, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 10)
• GitHub Check: internal / 🧪 Unit Tests: Internal (2, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 10)
• GitHub Check: internal / 🧪 Unit Tests: Internal (9, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (3, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (12, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (4, 12)
• GitHub Check: internal / 🧪 Unit Tests: Internal (6, 12)
• GitHub Check: sdk-compat / Node.js 24.18 (warp-ubuntu-latest-x64-4x)
• GitHub Check: sdk-compat / Node.js 26.4 (warp-ubuntu-latest-x64-4x)
• GitHub Check: packages / 🧪 Unit Tests: Packages (3, 3)
• GitHub Check: sdk-compat / Cloudflare Workers
• GitHub Check: typecheck / typecheck
• GitHub Check: packages / 🧪 Unit Tests: Packages (1, 3)
• GitHub Check: e2e / 🧪 CLI v3 tests (warp-windows-latest-x64-4x - pnpm)
• GitHub Check: packages / 🧪 Unit Tests: Packages (2, 3)
• GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp
• GitHub Check: Build and publish previews

---

Walkthrough

This PR adds support for marking environment variables synced via syncEnvVars as secrets. Array-form entries accept isSecret, secret values are emitted through build layers and manifests, and CLI deployment imports secret and non-secret variables separately. Tests, Vitest configuration, documentation, and a patch changeset were added.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: adding isSecret support to syncEnvVars.
Description check	✅ Passed	It includes the change summary, implementation details, commits, and testing, but omits the template's issue link and screenshot/checklist sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/sync-env-vars-is-secret-tri-11099

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@e084f22

trigger.dev

npm i https://pkg.pr.new/trigger.dev@e084f22

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@e084f22

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@e084f22

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@e084f22

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@e084f22

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@e084f22

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@e084f22

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@e084f22

commit: e084f22