Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

`secrets set` ignores `--workdir` and reads config.toml from the working directory

Cerrado
  • ¿Algo no está bien?
#7,354 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
58/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
cli

Línea de trabajo

Start in apps/cli/src/commands/secrets/set/set.handler.ts, where loadCliConfig and loadCliProjectEnvironment are called with runtimeInfo.cwd. Compare with apps/cli/src/commands/config/config.load.ts, which uses cliSettings.workdir, and with runtimeInfo.cwd in apps/cli/src/shared/runtime/runtime-info.layer.ts. Done when the repro run with --workdir ../clean from leaky/ fails with SecretsNoArgumentsError and sends no request.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

🐛 Bug supabase/cli

Describe the bug

supabase secrets set resolves supabase/config.toml by searching up from process.cwd(), so --workdir has no effect on which config it reads. The command merges that file's [edge_runtime.secrets] into its request body, so running it from a directory whose config declares local-only secrets pushes those values to the target project — even when --workdir points at a different, secret-free project directory.

config push, config diff and config pull do honour --workdir, which makes the behaviour of secrets set surprising.

To reproduce

mkdir -p leaky/supabase clean/supabase

cat > leaky/supabase/config.toml <<'EOF'
project_id = "leaky"

[edge_runtime.secrets]
LOCAL_ONLY = "http://127.0.0.1:54324"
EOF

printf 'project_id = "clean"\n' > clean/supabase/config.toml

cd leaky
supabase secrets set --project-ref <ref> --workdir ../clean --output-format json

No secrets are passed on the command line, so anything the command sends can only have come from a config file.

Expected behavior

--workdir ../clean is used, clean/supabase/config.toml declares no [edge_runtime.secrets], and the command fails with SecretsNoArgumentsError without sending a request.

Actual behavior

It reads leaky/supabase/config.toml and posts LOCAL_ONLY to the project:

{"_tag":"Error","error":{"code":"SecretsSetNetworkError","message":"failed to set secrets: TransportError"}}

(a request was built and attempted — here with outbound traffic blocked, to keep the test off a real project)

Running the identical command from clean/ instead gives:

{"_tag":"Error","error":{"code":"SecretsNoArgumentsError","message":"No arguments found. Use --env-file to read from a .env file."}}

So only the working directory decides which config is read.

Version

Reproduced on 2.118.0 and present in 2.122.0.

Where it comes from

apps/cli/src/commands/secrets/set/set.handler.ts calls loadCliConfig(runtimeInfo.cwd, …) and loadCliProjectEnvironment({ cwd: runtimeInfo.cwd, … }). runtimeInfo.cwd is process.cwd() in apps/cli/src/shared/runtime/runtime-info.layer.ts and never reflects --workdir. By contrast apps/cli/src/commands/config/config.load.ts loads from cliSettings.workdir and respects shouldSearchAncestors.

Why it matters

A natural way to keep local-only Edge Function secrets out of a hosted project is to keep them in one config.toml and run secrets set with --workdir pointed at another directory whose config has no secrets table. That doesn't work, and the merge is silent: nothing in the output names the secrets the config contributed, so the extra values are only visible afterwards in secrets list.

A fix could either honour --workdir here as the config commands do, or — separately useful — list the config-sourced names the command is about to send.

Lenguaje dominante
TypeScript
Estrellas
2.4k
Forks
537
Merge medio
17 h 22 min
PR fusionados (30 d)
391

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de supabase/cli

Todos los issues de supabase/cli

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.