Commit `10e3677ccc`

10e3677ccc296e84d995d41b685821c623b874da

parent: 629efd36ed

Unsigned

cmc <hello@cleberg.net> · 2026-07-20 15:21 UTC

Declare secret bindings so type checking works in CI

`wrangler types` discovers secret names from `.dev.vars`, which is
gitignored. A clean clone therefore generates an `Env` containing only
the bindings from wrangler.jsonc, and every `env.SESSION_SECRET` style
access fails with TS2339 — type checking passed locally and broke in
the build.

Declaring the secrets in an ambient interface merges with the generated
`Env`, so the contract lives in source and behaves identically on a
developer machine and in a fresh clone. It also documents what each
secret is for.

Verified both ways: type checking passes with `.dev.vars` absent (the
CI case) and present (where the generated file also declares them, and
the merge is clean because the types match).

Layout: unified · split

src/env.d.ts added +23

		@@ -0,0 +1,23 @@
	1	// Secrets are set with `wrangler secret put`, not declared in
	2	// wrangler.jsonc, so `wrangler types` can only discover their names from a
	3	// local `.dev.vars` — which is gitignored and therefore absent in CI.
	4	// Declaring them here merges with the generated `Env` interface, so the
	5	// contract is explicit in source and type checking behaves the same on a
	6	// developer machine and in a clean clone.
	7	//
	8	// Keep in sync with `.dev.vars.example` and the secrets set on the Worker.
	9	interface Env {
	10	/** GitHub App ID, for minting the App JWT. */
	11	GITHUB_APP_ID: string;
	12	/** GitHub App private key (PEM). PKCS#1 or PKCS#8 both accepted. */
	13	GITHUB_APP_PRIVATE_KEY: string;
	14	/** Shared secret used to verify inbound webhook signatures. */
	15	GITHUB_WEBHOOK_SECRET: string;
	16	/** OAuth client credentials for dashboard sign-in. */
	17	GITHUB_APP_CLIENT_ID: string;
	18	GITHUB_APP_CLIENT_SECRET: string;
	19	/** HMAC key for signing session cookies. */
	20	SESSION_SECRET: string;
	21	/** Bearer token guarding the /admin/* routes. */
	22	ADMIN_TOKEN: string;
	23	}

Commit 10e3677ccc

Commit `10e3677ccc`