feat: add --secrets-file to cf previews deploy

.changeset/previews-deploy-secrets-file.md

@@ -0,0 +1,7 @@
+---
+"cf": minor
+---
+
+Add `--secrets-file` to `cf previews deploy`
+
+Use `cf previews deploy --secrets-file .env.preview` to upload secrets with a Preview deployment, in the same JSON or `.env` format that `cf deploy --secrets-file` accepts. Previously, Preview secrets could only be set in the Cloudflare dashboard or with Wrangler.

packages/cli/package.json

@@ -84,7 +84,7 @@
 		"@cloudflare/cli-shared-helpers": "0.3.4",
 		"@cloudflare/codemods": "0.7.4",
 		"@cloudflare/containers-shared": "0.23.9",
-		"@cloudflare/deploy-helpers": "0.26.0",
+		"@cloudflare/deploy-helpers": "https://pkg.pr.new/cloudflare/workers-sdk/@cloudflare/deploy-helpers@b05642f25d4efdcd5fc54dc33b5767dc19f002bb",
 		"@cloudflare/forge": "https://pkg.pr.new/cloudflare/forge/@cloudflare/forge@0d1877431691b07cbe3b042a4b64cb0bd8e81c03",
 		"@cloudflare/workers-auth": "0.16.0",
 		"@cloudflare/workers-utils": "0.52.0",

packages/cli/src/__tests__/commands/hand-written-metadata.test.ts

@@ -175,6 +175,17 @@ describe("hand-written command metadata", () => {
 		});
 	});
 
+	it("publishes Preview secrets-file metadata", () => {
+		expect(commands.get("cf previews deploy")?.options).toContainEqual({
+			name: "secrets-file",
+			type: "string",
+			required: false,
+			description: expect.stringMatching(
+				/^Path to a file containing secrets to upload with the Preview deployment /
+			),
+		});
+	});
+
 	it("publishes Quick Tunnel email protection for completions and tools", () => {
 		expect(commands.get("cf tunnels quick-start")?.options).toContainEqual(
 			expect.objectContaining({

packages/cli/src/__tests__/commands/previews-deploy.test.ts

@@ -242,6 +242,38 @@ describe("cf previews deploy", () => {
 		);
 	});
 
+	it("uploads secrets from --secrets-file", async () => {
+		const rootConfig = { buildContext: { isPreview: true } };
+		const worker = {
+			config: { type: "worker", name: "preview-worker" },
+			bundleDir: "/project/bundle",
+		};
+		mocks.readBuildOutput.mockResolvedValue({
+			rootConfig,
+			workers: { default: worker },
+		});
+		mocks.assembleBuildResult.mockReturnValue({ content: "worker code" });
+		mocks.getAuthToken.mockResolvedValue("token");
+		mocks.getAccountId.mockResolvedValue("account-id");
+		mocks.createDeployContext.mockReturnValue({
+			logger: { log: vi.fn(), info: vi.fn() },
+		});
+		mocks.previewBuildOutput.mockResolvedValue(previewResult);
+
+		await runPreviewDeploy({
+			"preview-name": "feature",
+			prebuilt: true,
+			"secrets-file": ".env.preview",
+		} as Parameters<typeof runPreviewDeploy>[0]);
+
+		expect(mocks.previewBuildOutput).toHaveBeenCalledWith(
+			"account-id",
+			{ name: "feature", json: true, secretsFile: ".env.preview" },
+			expect.any(Object),
+			expect.any(Object)
+		);
+	});
+
 	it("uses the built region to select an account when output omits its ID", async () => {
 		const worker = {
 			config: {

packages/cli/src/commands/deploy/secrets-file-description.ts

@@ -1,2 +1,8 @@
-export const secretsFileDescription =
-	"Path to a file containing secrets to upload with the version (JSON or .env format). Dotenv values expand $VAR and ${VAR} using process environment values and earlier file values; process environment values override file values, including empty values. Only declared file keys are uploaded. Only use trusted dotenv secrets files: they can read and upload any process environment value. Escape literal dollar signs with \\$ or use JSON.";
+function describeSecretsFile(upload: string) {
+	return `Path to a file containing secrets to upload with the ${upload} (JSON or .env format). Dotenv values expand $VAR and \${VAR} using process environment values and earlier file values; process environment values override file values, including empty values. Only declared file keys are uploaded. Only use trusted dotenv secrets files: they can read and upload any process environment value. Escape literal dollar signs with \\$ or use JSON.`;
+}
+
+export const secretsFileDescription = describeSecretsFile("version");
+
+export const previewSecretsFileDescription =
+	describeSecretsFile("Preview deployment");

packages/cli/src/commands/previews/deploy.ts

@@ -33,6 +33,7 @@ import {
 	createContainerDeployConfig,
 	isLiveContainerExport,
 } from "../deploy/containers.js";
+import { previewSecretsFileDescription } from "../deploy/secrets-file-description.js";
 import {
 	prepareStaticAssetsBuildOutput,
 	staticAssetsDirectoryOption,
@@ -56,7 +57,12 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 				"Use existing Preview Build Output Specification files without building",
 			default: false,
 		})
-		.option("worker", buildOutputWorkerOption);
+		.option("worker", buildOutputWorkerOption)
+		.option("secrets-file", {
+			type: "string",
+			description: previewSecretsFileDescription,
+			requiresArg: true,
+		});
 }
 
 type PreviewDeployArgs = InferArgs<typeof builder>;
@@ -185,7 +191,7 @@ async function deployPreviewBuildOutput(
 
 	const result = await previewBuildOutput(
 		accountId,
-		{ name: previewName, json: true },
+		{ name: previewName, json: true, secretsFile: argv["secrets-file"] },
 		{
 			workerConfig: builtConfig,
 			rootConfig: output.rootConfig,

packages/cli/src/commands/previews/deploy/meta.ts

@@ -1,3 +1,4 @@
+import { previewSecretsFileDescription } from "../../deploy/secrets-file-description.js";
 import type { LeafCommandMeta } from "../../../lib/command-meta.js";
 
 export default {
@@ -40,6 +41,12 @@ export default {
 			description:
 				"Name of the Worker in the Build Output to use (defaults to the default Worker)",
 		},
+		{
+			name: "secrets-file",
+			type: "string",
+			required: false,
+			description: previewSecretsFileDescription,
+		},
 		{
 			name: "dry-run",
 			type: "boolean",

pnpm-workspace.yaml

@@ -8,7 +8,7 @@ patchedDependencies:
   "@cloudflare/deploy-helpers@*": patches/@cloudflare__deploy-helpers@0.20.1.patch
 
 # Prevent transitive deps from pulling from git / tarball URLs.
-# Direct deps (the pinned pkg.pr.new Forge build) are allowed.
+# Direct deps (the pinned pkg.pr.new Forge and deploy-helpers builds) are allowed.
 blockExoticSubdeps: true
 
 # Allow Cloudflare release batches before pnpm's maturity cutoff. Keep these
@@ -34,6 +34,12 @@ catalog:
   vite: npm:@voidzero-dev/vite-plus-core@1.4.0
   vite-plus: 1.4.0
 overrides:
+  # The deploy-helpers preview rewrites sibling deps to previews of these same
+  # released versions. Retain cf's shared instances and container cleanup patch.
+  "@cloudflare/deploy-helpers@0.26.0>@cloudflare/config": "0.30.2"
+  "@cloudflare/deploy-helpers@0.26.0>@cloudflare/containers-shared": "0.23.9"
+  "@cloudflare/deploy-helpers@0.26.0>@cloudflare/workers-utils": "0.52.0"
+  "@cloudflare/deploy-helpers@0.26.0>miniflare": "5.20261104.0-beta"
   vite@*: "catalog:"
   vitest@*: 5.0.5
 peerDependencyRules: