audit-labs/gh-attest

GitHub Audit Evidence Extractor

clone: git clone https://gitbay.org/audit-labs/gh-attest.git

613efc1bdb765dc9dd6f0c4a00f00cbafcf1eeeb

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-07-20T15:21:40Z

Declare secret bindings so type checking works in CI

`wrangler types` discovers secret names from `.dev.vars`, which is
gitignored. A clean clone therefore generates an `Env` containing only
the bindings from wrangler.jsonc, and every `env.SESSION_SECRET` style
access fails with TS2339 — type checking passed locally and broke in
the build.

Declaring the secrets in an ambient interface merges with the generated
`Env`, so the contract lives in source and behaves identically on a
developer machine and in a fresh clone. It also documents what each
secret is for.

Verified both ways: type checking passes with `.dev.vars` absent (the
CI case) and present (where the generated file also declares them, and
the merge is clean because the types match).

 src/env.d.ts | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/env.d.ts b/src/env.d.ts
new file mode 100644
index 0000000..2c7aa7a
--- /dev/null
+++ b/src/env.d.ts
@@ -0,0 +1,23 @@
+// Secrets are set with `wrangler secret put`, not declared in
+// wrangler.jsonc, so `wrangler types` can only discover their names from a
+// local `.dev.vars` — which is gitignored and therefore absent in CI.
+// Declaring them here merges with the generated `Env` interface, so the
+// contract is explicit in source and type checking behaves the same on a
+// developer machine and in a clean clone.
+//
+// Keep in sync with `.dev.vars.example` and the secrets set on the Worker.
+interface Env {
+  /** GitHub App ID, for minting the App JWT. */
+  GITHUB_APP_ID: string;
+  /** GitHub App private key (PEM). PKCS#1 or PKCS#8 both accepted. */
+  GITHUB_APP_PRIVATE_KEY: string;
+  /** Shared secret used to verify inbound webhook signatures. */
+  GITHUB_WEBHOOK_SECRET: string;
+  /** OAuth client credentials for dashboard sign-in. */
+  GITHUB_APP_CLIENT_ID: string;
+  GITHUB_APP_CLIENT_SECRET: string;
+  /** HMAC key for signing session cookies. */
+  SESSION_SECRET: string;
+  /** Bearer token guarding the /admin/* routes. */
+  ADMIN_TOKEN: string;
+}