test(build): cover syncEnvVars isSecret partitioning + docs

Author: isshaddad

docs/config/extensions/syncEnvVars.mdx

@@ -32,6 +32,33 @@ The callback is passed a context object with the following properties:
 - `projectRef`: The project ref of the Trigger.dev project
 - `env`: The environment variables that are currently set in the Trigger.dev project
 
+### Marking variables as secrets
+
+Return the array form and set `isSecret: true` on any variable you want stored as a [secret](/deploy-environment-variables). Secret env vars are redacted in the dashboard and their values can't be revealed after they're set, just like manually created secret variables. You can mix secret and non-secret variables in the same callback.
+
+```ts
+import { defineConfig } from "@trigger.dev/sdk";
+import { syncEnvVars } from "@trigger.dev/build/extensions/core";
+
+export default defineConfig({
+  build: {
+    extensions: [
+      syncEnvVars(async (ctx) => {
+        return [
+          { name: "PUBLIC_API_URL", value: "https://api.example.com" },
+          { name: "DATABASE_URL", value: "postgres://...", isSecret: true },
+        ];
+      }),
+    ],
+  },
+});
+```
+
+<Note>
+  `isSecret` is only available when you return the array form (`{ name, value, isSecret }`). The
+  record form (`{ KEY: "value" }`) always creates non-secret variables.
+</Note>
+
 ### Example: Sync env vars from Infisical
 
 In this example we're using env vars from [Infisical](https://infisical.com).

packages/build/package.json

@@ -74,7 +74,8 @@
     "dev": "tshy --watch",
     "typecheck": "tsc --noEmit -p tsconfig.src.json",
     "update-version": "tsx ../../scripts/updateVersion.ts",
-    "check-exports": "attw --pack ."
+    "check-exports": "attw --pack .",
+    "test": "vitest"
   },
   "dependencies": {
     "@prisma/config": "^6.10.0",

packages/build/src/extensions/core/syncEnvVars.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, it } from "vitest";
+import type { BuildContext, BuildLayer } from "@trigger.dev/core/v3/build";
+import { syncEnvVars, type SyncEnvVarsFunction } from "./syncEnvVars.js";
+
+async function runExtension(fn: SyncEnvVarsFunction): Promise<BuildLayer | undefined> {
+  let captured: BuildLayer | undefined;
+
+  const context = {
+    target: "deploy",
+    config: { project: "proj_test" },
+    logger: {
+      spinner: () => ({ stop: () => {} }),
+    },
+    addLayer: (layer: BuildLayer) => {
+      captured = layer;
+    },
+  } as unknown as BuildContext;
+
+  const manifest = {
+    deploy: { env: {} },
+    environment: "prod",
+    branch: undefined,
+  } as any;
+
+  const extension = syncEnvVars(fn);
+  await extension.onBuildComplete!(context, manifest);
+
+  return captured;
+}
+
+describe("syncEnvVars isSecret", () => {
+  it("partitions secret and non-secret vars across child and parent", async () => {
+    const layer = await runExtension(() => [
+      { name: "PUBLIC_URL", value: "https://example.com" },
+      { name: "API_KEY", value: "secret-key", isSecret: true },
+      { name: "PARENT_PUBLIC", value: "parent", isParentEnv: true },
+      { name: "PARENT_SECRET", value: "parent-secret", isParentEnv: true, isSecret: true },
+    ]);
+
+    expect(layer?.deploy?.env).toEqual({ PUBLIC_URL: "https://example.com" });
+    expect(layer?.deploy?.secretEnv).toEqual({ API_KEY: "secret-key" });
+    expect(layer?.deploy?.parentEnv).toEqual({ PARENT_PUBLIC: "parent" });
+    expect(layer?.deploy?.secretParentEnv).toEqual({ PARENT_SECRET: "parent-secret" });
+  });
+
+  it("treats the record form as all non-secret", async () => {
+    const layer = await runExtension(() => ({ DATABASE_URL: "postgres://..." }));
+
+    expect(layer?.deploy?.env).toEqual({ DATABASE_URL: "postgres://..." });
+    expect(layer?.deploy?.secretEnv).toBeUndefined();
+    expect(layer?.deploy?.secretParentEnv).toBeUndefined();
+  });
+
+  it("omits secret buckets when no var is marked secret", async () => {
+    const layer = await runExtension(() => [{ name: "PUBLIC_URL", value: "https://example.com" }]);
+
+    expect(layer?.deploy?.env).toEqual({ PUBLIC_URL: "https://example.com" });
+    expect(layer?.deploy?.secretEnv).toBeUndefined();
+    expect(layer?.deploy?.secretParentEnv).toBeUndefined();
+  });
+});

packages/build/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["src/**/*.test.ts"],
+    globals: true,
+  },
+});