Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

workers secrets bulk: --file and unwrapped bodies silently create an empty version + 100% deployment with no error

Aperta
  • Qualcosa non va?
#201 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
62/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
cli

Direzione di ricerca

Start from the workers secrets bulk command implementation in the cf CLI TypeScript sources; grep the command name and octet-stream to find where --file sets the request body kind. Compare that path with --body @file, and find where (if anywhere) the secrets wrapper is validated before the PATCH is sent. Reproduce with --dry-run to see bodyKind, then make the --file path send JSON and reject or warn on an empty change set; done means both paths either apply the secret or fail loudly.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

upstream

What happened

cf workers secrets bulk can silently no-op: it reports success, creates a new Worker version, and even creates a 100% deployment — but with zero binding changes, and no error anywhere. Two distinct paths produce this:

  1. --file sends the request body as application/octet-stream (visible via --dry-run: "bodyKind": "octet-stream"). The secrets-bulk PATCH endpoint apparently cannot parse that body, so the change set is empty.
  2. A bare top-level map body via --body/--body @file, e.g. {"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "..."}}. The API contract requires the map to be wrapped in a secrets field — {"secrets": {"MY_SECRET": {...}}} (per the generated CLI help text and the cloudflare TS/Go SDKs, where the params object is {secrets: Record<string, ScriptSecretBulkUpdateParamsSecrets>}). An unwrapped map is silently treated as an empty merge patch.

Both paths return success: true with the current bindings manifest as the result, and both create a new version annotated workers/triggered_by: secret plus a 100% deployment. Operators who trust the exit code (0) or the success response will believe the secret landed when it did not.

Repro

# 1. --file path (octet-stream, silent no-op)
echo '{"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "value"}}' > body.json
cf workers secrets bulk --worker my-worker --file body.json
# -> success, new version created, MY_SECRET absent from the version's bindings

# 2. unwrapped --body (silent no-op)
cf workers secrets bulk --worker my-worker --body @body.json
# -> same result

# 3. wrapped --body (works)
echo '{"secrets": {"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "value"}}}' > body2.json
cf workers secrets bulk --worker my-worker --body @body2.json
# -> MY_SECRET present in the new version's bindings

Verify with cf workers versions list --worker-id my-worker (inspect the new version's bindings) or cf workers secrets get MY_SECRET --worker my-worker.

Expected behaviour

  • --file should deliver the file contents as a JSON request body (the same body --body @file produces), or the flag should be rejected for commands whose body is JSON.
  • A body that does not match the documented shape (missing secrets wrapper) should fail loudly — a client-side validation error or a surfaced API error — rather than being treated as an empty merge patch.
  • At minimum, the command should print a warning when the resulting change set is empty, since it creates a version + deployment as a side effect.

Versions

  • cf CLI: v1.0.0-beta.6 (delegated)
  • macOS arm64, observed 2026-10-04 against the workers secrets bulk command (PATCH /accounts/{account_id}/workers/scripts/{script_name}/secrets-bulk).
Lingua principale
TypeScript
Stelle
916
Fork
53
Merge medio
19h 13m
PR unite (30g)
185

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di cloudflare/cf

Tutte le issue di cloudflare/cf

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.