Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

`secrets set` ignores `--workdir` and reads config.toml from the working directory

クローズ
  • 何か問題がありますか？
#7,354 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
半日
初心者へのやさしさ
58/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
typescript
領域
cli

調査の方向性

Start in apps/cli/src/commands/secrets/set/set.handler.ts, where loadCliConfig and loadCliProjectEnvironment are called with runtimeInfo.cwd. Compare with apps/cli/src/commands/config/config.load.ts, which uses cliSettings.workdir, and with runtimeInfo.cwd in apps/cli/src/shared/runtime/runtime-info.layer.ts. Done when the repro run with --workdir ../clean from leaky/ fails with SecretsNoArgumentsError and sends no request.

索引モデルが issue の本文から書いたものです。

説明

🐛 Bug supabase/cli

Describe the bug

supabase secrets set resolves supabase/config.toml by searching up from process.cwd(), so --workdir has no effect on which config it reads. The command merges that file's [edge_runtime.secrets] into its request body, so running it from a directory whose config declares local-only secrets pushes those values to the target project — even when --workdir points at a different, secret-free project directory.

config push, config diff and config pull do honour --workdir, which makes the behaviour of secrets set surprising.

To reproduce

mkdir -p leaky/supabase clean/supabase

cat > leaky/supabase/config.toml <<'EOF'
project_id = "leaky"

[edge_runtime.secrets]
LOCAL_ONLY = "http://127.0.0.1:54324"
EOF

printf 'project_id = "clean"\n' > clean/supabase/config.toml

cd leaky
supabase secrets set --project-ref <ref> --workdir ../clean --output-format json

No secrets are passed on the command line, so anything the command sends can only have come from a config file.

Expected behavior

--workdir ../clean is used, clean/supabase/config.toml declares no [edge_runtime.secrets], and the command fails with SecretsNoArgumentsError without sending a request.

Actual behavior

It reads leaky/supabase/config.toml and posts LOCAL_ONLY to the project:

{"_tag":"Error","error":{"code":"SecretsSetNetworkError","message":"failed to set secrets: TransportError"}}

(a request was built and attempted — here with outbound traffic blocked, to keep the test off a real project)

Running the identical command from clean/ instead gives:

{"_tag":"Error","error":{"code":"SecretsNoArgumentsError","message":"No arguments found. Use --env-file to read from a .env file."}}

So only the working directory decides which config is read.

Version

Reproduced on 2.118.0 and present in 2.122.0.

Where it comes from

apps/cli/src/commands/secrets/set/set.handler.ts calls loadCliConfig(runtimeInfo.cwd, …) and loadCliProjectEnvironment({ cwd: runtimeInfo.cwd, … }). runtimeInfo.cwd is process.cwd() in apps/cli/src/shared/runtime/runtime-info.layer.ts and never reflects --workdir. By contrast apps/cli/src/commands/config/config.load.ts loads from cliSettings.workdir and respects shouldSearchAncestors.

Why it matters

A natural way to keep local-only Edge Function secrets out of a hosted project is to keep them in one config.toml and run secrets set with --workdir pointed at another directory whose config has no secrets table. That doesn't work, and the merge is silent: nothing in the output names the secrets the config contributed, so the extra values are only visible afterwards in secrets list.

A fix could either honour --workdir here as the config commands do, or — separately useful — list the config-sourced names the command is about to send.

主要言語
TypeScript
スター
2.4k
フォーク
537
平均マージ
18時間 2分
マージ済み PR（30日）
387

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

supabase/cli のほかの issue

supabase/cli の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。