fix(trigger): keep secret text out of env sync errors and refuse an unknown sync target

Merged
WA
5d ago
+109-21

Summary

Follow-ups to #9632 (Trigger.dev env sync from the app's Secrets Manager secret), from a final review of the release branch.

  • Keep secret text out of the error. A malformed env-vars secret failed with the JSON parser's message, which quotes the text around the fault (part of a value), and the Trigger.dev deploy prints that error to a public CI log. The error now names only the failure.
  • Refuse a malformed sync-target list. TRIGGER_ENV_SYNC_TARGETS was split on commas with no validation, so Staging or a typo silently kept the environment on the old path. parseTriggerEnvSyncTargets (next to APP_ENV_SECRET_IDS) accepts only the exact comma list the deploy workflows' credential checks match, and refuses a padded, empty, or unknown entry (checked by own key, so constructor cannot pass); the deploy exits on it (syncEnvVars swallows throws) and logs which path it took. resolveTriggerEnvFromAppSecret uses the same own-key lookup.
  • Accurate docs. The sync TSDoc now says the CLI applies variables when it uploads the version (before promotion) and that the sync only adds or updates; fetchRuntimeSecrets retries every failed request (not only transient ones); the worker-marker comments point at TRIGGER_CONSTANT_VARS; FUNCTION_EXECUTION_ENV notes it applies only outside the sync list.

Type of Change

  • Bug fix

Testing

  • packages/runtime-secrets: keeps the secret text out of a malformed-JSON error (red on the old code: the message contained the value); parseTriggerEnvSyncTargets reads the exact list, treats an unset gate as none, and refuses padded, empty, and unknown entries (red with trimming restored, or with in instead of an own-key check). 13/13.
  • type-check for packages/runtime-secrets and apps/sim; lint and type-check (pre-push hooks); remaining audits in CI

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)