Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

workers secrets bulk: --file and unwrapped bodies silently create an empty version + 100% deployment with no error

Abierto
  • ¿Algo no está bien?
#201 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
62/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
cli

Línea de trabajo

Start from the workers secrets bulk command implementation in the cf CLI TypeScript sources; grep the command name and octet-stream to find where --file sets the request body kind. Compare that path with --body @file, and find where (if anywhere) the secrets wrapper is validated before the PATCH is sent. Reproduce with --dry-run to see bodyKind, then make the --file path send JSON and reject or warn on an empty change set; done means both paths either apply the secret or fail loudly.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

upstream

What happened

cf workers secrets bulk can silently no-op: it reports success, creates a new Worker version, and even creates a 100% deployment — but with zero binding changes, and no error anywhere. Two distinct paths produce this:

  1. --file sends the request body as application/octet-stream (visible via --dry-run: "bodyKind": "octet-stream"). The secrets-bulk PATCH endpoint apparently cannot parse that body, so the change set is empty.
  2. A bare top-level map body via --body/--body @file, e.g. {"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "..."}}. The API contract requires the map to be wrapped in a secrets field — {"secrets": {"MY_SECRET": {...}}} (per the generated CLI help text and the cloudflare TS/Go SDKs, where the params object is {secrets: Record<string, ScriptSecretBulkUpdateParamsSecrets>}). An unwrapped map is silently treated as an empty merge patch.

Both paths return success: true with the current bindings manifest as the result, and both create a new version annotated workers/triggered_by: secret plus a 100% deployment. Operators who trust the exit code (0) or the success response will believe the secret landed when it did not.

Repro

# 1. --file path (octet-stream, silent no-op)
echo '{"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "value"}}' > body.json
cf workers secrets bulk --worker my-worker --file body.json
# -> success, new version created, MY_SECRET absent from the version's bindings

# 2. unwrapped --body (silent no-op)
cf workers secrets bulk --worker my-worker --body @body.json
# -> same result

# 3. wrapped --body (works)
echo '{"secrets": {"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "value"}}}' > body2.json
cf workers secrets bulk --worker my-worker --body @body2.json
# -> MY_SECRET present in the new version's bindings

Verify with cf workers versions list --worker-id my-worker (inspect the new version's bindings) or cf workers secrets get MY_SECRET --worker my-worker.

Expected behaviour

  • --file should deliver the file contents as a JSON request body (the same body --body @file produces), or the flag should be rejected for commands whose body is JSON.
  • A body that does not match the documented shape (missing secrets wrapper) should fail loudly — a client-side validation error or a surfaced API error — rather than being treated as an empty merge patch.
  • At minimum, the command should print a warning when the resulting change set is empty, since it creates a version + deployment as a side effect.

Versions

  • cf CLI: v1.0.0-beta.6 (delegated)
  • macOS arm64, observed 2026-10-04 against the workers secrets bulk command (PATCH /accounts/{account_id}/workers/scripts/{script_name}/secrets-bulk).
Lenguaje dominante
TypeScript
Estrellas
853
Forks
42
Merge medio
18 h 31 min
PR fusionados (30 d)
172

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de cloudflare/cf

Todos los issues de cloudflare/cf

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.