[wrangler] Add --secrets-file and --var flags to wrangler preview - #15256
[wrangler] Add --secrets-file and --var flags to wrangler preview#15256theoephraim wants to merge 5 commits into
Conversation
🦋 Changeset detectedLatest commit: a96bda4 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Codeowners approval required for this PR:
Show detailed file reviewers
|
@cloudflare/autoconfig
@cloudflare/build-output-utils
@cloudflare/codemods
@cloudflare/config
create-cloudflare
@cloudflare/deploy-helpers
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-functions
@cloudflare/pages-shared
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-plugin
@cloudflare/workers-auth
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
commit: |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| // Vars from the CLI (--var) override same-named vars from the previews config | ||
| for (const [varName, varValue] of Object.entries(options.cliVars ?? {})) { | ||
| env[varName] = { type: "plain_text", text: varValue }; | ||
| } |
There was a problem hiding this comment.
🟨 CLI-provided variables are sent to the preview API without the marker used elsewhere to keep values out of logs
The deploy and versions-upload paths tag --var values with hidden: true specifically so their values are never printed (packages/deploy-helpers/src/deploy/deploy.ts:246-252, packages/deploy-helpers/src/deploy/versions-upload.ts:102-108, consumed at packages/deploy-helpers/src/deploy/helpers/print-bindings.ts:737-744). The new preview path adds the same CLI-supplied values as plain { type: "plain_text", text } bindings with no hidden marker, so if any current or future preview output path renders binding values (e.g. preview settings display, or --json, which prints the API's echoed deployment env at packages/deploy-helpers/src/preview/preview.ts:470-473), values passed on the command line could be written to the terminal or output file.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
The hidden marker is client-side display metadata only — even in the deploy path it's stripped before upload (create-worker-upload-form.ts sends just {name, type: "plain_text", text}) and it's consumed solely by print-bindings.ts, which the preview command doesn't use. Preview's human-readable output never prints binding values, so there's no output path for the marker to guard, and the previews API has no such field. --json intentionally echoes the API's deployment resource verbatim — the same data any deployment GET returns. Per the flag docs, sensitive values should go through --secrets-file, which sends them as secret_text.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
e26b989 to
db1443c
Compare
|
Changes LGTM, though we do have merge conflicts which we'll want to fix up before approvals :) |
db1443c to
d039273
Compare
|
Codeowners approval required for this PR:
Show detailed file reviewers
|
d039273 to
8c280ed
Compare
Extend --secrets-file-mode to the private beta preview surface, on top of the base --secrets-file/--var support for wrangler preview added in the preview-secrets-file-var-flags branch (PR cloudflare#15256). With --secrets-file-mode replace, wrangler preview converges the new Preview deployment's secret set to the file by reading the effective env off the create response and cutting one follow-up deployment that deletes the unlisted secrets (the server-side merge of base config and carried-over secrets cannot be suppressed in the create request); the secret-value redaction now runs after that convergence so the follow-up deployment's echoed env is redacted too. wrangler preview secret bulk accepts --secrets-file-mode replace as well, deleting existing secrets not present in the input within the same patch. secrets.required names are never dropped, the deletion warning is always logged, and behavior without the new flag is unchanged.
A bad file path or malformed contents now fails before the preview resource is created or assets are uploaded, instead of leaving a half-finished preview behind.
The API may echo the uploaded env on the deployment response; strip secret_text values as soon as it is received so --json output can never print them, matching how preview secret list only outputs names/types.
The diverged-config warning compared top-level bindings against config preview bindings only, so names supplied via --var or --secrets-file were reported as missing even though they were uploaded. Compare against the env that was actually sent with the deployment instead.
…tests Preview deployments are now uploaded as multipart form data (cloudflare#15375), so the secrets/vars test mocks read the request via the shared readPreviewDeploymentRequest helper instead of request.json().
c3ee1ae to
a96bda4
Compare
|
@WillTaylorDev - let me know if there is anything else I can help with to get this over the finish line! Your time is much appreciated. Also fyi - somewhat related discussions over in #15122 |
3 participants
Adds
--secrets-fileand--varflags to thewrangler previewcommand [private beta], matching the equivalent flags onwrangler deployandwrangler versions upload.--secrets-file <path>is parsed with the sharedparseBulkInputToObjecthelper (JSON or .env format) and the secrets are sent assecret_textbindings on the Preview deployment.--var KEY:VALUEpairs are parsed withcollectKeyValuesand sent asplain_textbindings.previewsvars →--var→--secrets-file, matching howwrangler deploylayers these sources.Note: this deliberately does not add
--defineand--alias(which deploy/versions also support) — the preview command currently reads those only from config. They can be added later if needed.Motivation: these flags let env/secret management tooling inject values into Preview deployments the same way it already can for
deployandversions upload, without writing them into the Wrangler config file. Concretely, varlock's wrangler integration uses them to pass non-sensitive values via--varand sensitive values via--secrets-file— see the companion PR: dmno-dev/varlock#1018.wrangler previewis in private beta and not yet publicly documented.