Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

`secrets set` ignores `--workdir` and reads config.toml from the working directory

已关闭
  • 哪里不对？
#7,354 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
半天
新手友好度
58/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
typescript
领域
cli

调研方向

Start in apps/cli/src/commands/secrets/set/set.handler.ts, where loadCliConfig and loadCliProjectEnvironment are called with runtimeInfo.cwd. Compare with apps/cli/src/commands/config/config.load.ts, which uses cliSettings.workdir, and with runtimeInfo.cwd in apps/cli/src/shared/runtime/runtime-info.layer.ts. Done when the repro run with --workdir ../clean from leaky/ fails with SecretsNoArgumentsError and sends no request.

由索引模型根据 Issue 内容生成。

描述

🐛 Bug supabase/cli

Describe the bug

supabase secrets set resolves supabase/config.toml by searching up from process.cwd(), so --workdir has no effect on which config it reads. The command merges that file's [edge_runtime.secrets] into its request body, so running it from a directory whose config declares local-only secrets pushes those values to the target project — even when --workdir points at a different, secret-free project directory.

config push, config diff and config pull do honour --workdir, which makes the behaviour of secrets set surprising.

To reproduce

mkdir -p leaky/supabase clean/supabase

cat > leaky/supabase/config.toml <<'EOF'
project_id = "leaky"

[edge_runtime.secrets]
LOCAL_ONLY = "http://127.0.0.1:54324"
EOF

printf 'project_id = "clean"\n' > clean/supabase/config.toml

cd leaky
supabase secrets set --project-ref <ref> --workdir ../clean --output-format json

No secrets are passed on the command line, so anything the command sends can only have come from a config file.

Expected behavior

--workdir ../clean is used, clean/supabase/config.toml declares no [edge_runtime.secrets], and the command fails with SecretsNoArgumentsError without sending a request.

Actual behavior

It reads leaky/supabase/config.toml and posts LOCAL_ONLY to the project:

{"_tag":"Error","error":{"code":"SecretsSetNetworkError","message":"failed to set secrets: TransportError"}}

(a request was built and attempted — here with outbound traffic blocked, to keep the test off a real project)

Running the identical command from clean/ instead gives:

{"_tag":"Error","error":{"code":"SecretsNoArgumentsError","message":"No arguments found. Use --env-file to read from a .env file."}}

So only the working directory decides which config is read.

Version

Reproduced on 2.118.0 and present in 2.122.0.

Where it comes from

apps/cli/src/commands/secrets/set/set.handler.ts calls loadCliConfig(runtimeInfo.cwd, …) and loadCliProjectEnvironment({ cwd: runtimeInfo.cwd, … }). runtimeInfo.cwd is process.cwd() in apps/cli/src/shared/runtime/runtime-info.layer.ts and never reflects --workdir. By contrast apps/cli/src/commands/config/config.load.ts loads from cliSettings.workdir and respects shouldSearchAncestors.

Why it matters

A natural way to keep local-only Edge Function secrets out of a hosted project is to keep them in one config.toml and run secrets set with --workdir pointed at another directory whose config has no secrets table. That doesn't work, and the merge is silent: nothing in the output names the secrets the config contributed, so the extra values are only visible afterwards in secrets list.

A fix could either honour --workdir here as the config commands do, or — separately useful — list the config-sourced names the command is about to send.

主要语言
TypeScript
星标
2.4k
派生
537
平均合并
18 小时 2 分钟
30 天内合并 PR
387

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

supabase/cli 的其他 Issue

查看 supabase/cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。