Skip to content

v1.21.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 20:09
v1.21.0
46eccb5

Config lived in six hand-maintained lists that drifted apart: secrets.example.env, .dev.vars.example, wrangler.example.toml, scripts/setup.sh, the AGENTS-OPERATE §5 table, and release-manifest.json. This release makes one registry the source of truth for all 53 entries and adds a bulk path for setting secrets. Closes #42.

Highlights

  • Bulk secrets. cp secrets.example.env secrets.env, uncomment what you have, then npx wrangler secret bulk secrets.env && rm secrets.env — one call instead of ~24 interactive wrangler secret put prompts. secrets*.env is gitignored. Leave anything you don't have commented: wrangler treats an uncommented empty value as a real, empty secret and will overwrite a live key with nothing.
  • scripts/setup.sh now offers bulk or one-prompt-per-secret, and covers all 23 secrets. It previously prompted for 16 — CF_API_TOKEN, GITHUB_TOKEN, SPAM_FORM_TS_SECRET and the AKISMET_* pair were never offered. The six ID+secret pairs (Turnstile and the five OAuth providers) collapse behind one prompt each; Telegram's two secrets prompt separately, since the bot token alone enables outbound notifications.
  • One registry. scripts/config-registry.ts holds all 53 entries (23 secrets, 30 vars). secrets.example.env, .dev.vars.example, wrangler.example.toml, setup.sh's prompt lists and the AGENTS-OPERATE §5 table are generated by npm run config:build; npm run config:check fails CI on drift.
  • New optional secret: GITHUB_TOKEN — a read-only public_repo token that raises the 60 req/hr GitHub API cap used by update checks. Nothing breaks without it.

Fixes

  • npm run upgrade now reports optional secrets added since your installed release. They were previously invisible, passing neither the required-only secret diff nor the vars-only "new settings" filter.
  • "New settings" is keyed on addedIn rather than a manifest set-difference, so upgrading from an older install no longer lists settings you already have.
  • wrangler.example.toml's [secrets] required = [...] block ships commented out, with the reason inline: declaring it makes wrangler dev bind only the listed names out of .dev.vars and silently drop every other secret, so local OAuth, Resend, Akismet and Telegram read as unconfigured.
  • .dev.vars.example again points at Cloudflare's always-pass Turnstile test keys for local dev.
  • GITHUB_TOKEN is declared in the Bindings type.

Notes

  • No D1 migrations and no new required secrets — upgrading is redeploy-only. Run npm run upgrade to see the plan for your install.
  • The Node.js 24 floor from 1.20.0 still appears in the upgrade plan's breaking-changes section. If you are already on 1.20.0 or later there is nothing to do; the entry is not yet version-scoped.
Assets 5
Loading