feat(config): lint .env files and enforce no cross-layer key conflicts - #3478
Draft
stalniy wants to merge 4 commits into
Draft
feat(config): lint .env files and enforce no cross-layer key conflicts#3478stalniy wants to merge 4 commits into
stalniy wants to merge 4 commits into
Conversation
Add a dotenv-linter based check (script/lint-env.mjs) wired into the
per-app CI matrix (reusable-validate-app.yml). For each app it verifies:
- file hygiene via dotenv-linter (duplicate keys, syntax, blank lines),
ignoring checks that conflict with intentional conventions
(UnorderedKey, SubstitutionKey, QuoteCharacter, LowercaseKey)
- no key is shared across files that layer together at runtime
(.env, .env.${DEPLOYMENT_ENV}, .env.${NETWORK}), detected by merging
each layered pair and reusing dotenv-linter's DuplicatedKey check
- .env.production and .env.staging declare the same key set
- .env.sandbox and .env.mainnet declare the same key set
Fix the pre-existing violations the check surfaced:
- api: add PORT and PROVIDER_PROXY_URL to .env.staging
- deploy-web: add TRIAL_CREDITS_AMOUNT and the blocked GPU models list to
.env.staging; drop the optional GTM id from .env.production
- stats-web: add GA measurement id to .env.staging
- hygiene fixes (trailing/extra blank lines, missing values, quoting)
across several apps
provider-console is temporarily excluded from the layering checks: its
base .env holds mainnet defaults duplicated in the overlays and its
.env.production is empty, so restructuring its env layering is left to a
dedicated follow-up owned by that team.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 2 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughAdds a Node.js environment-file linter with dotenv-linter checks, integrates it into npm and reusable CI validation, documents usage, and updates application environment files. ChangesEnvironment linting
Estimated code review effort: 3 (Moderate) | ~25 minutes Assessment against linked issues
Out-of-scope changes
Possibly related PRs
Suggested reviewers: ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3478 +/- ##
=======================================
Coverage 72.87% 72.88%
=======================================
Files 1133 1133
Lines 29484 29484
Branches 7389 7393 +4
=======================================
+ Hits 21487 21489 +2
- Misses 7042 7046 +4
+ Partials 955 949 -6
🚀 New features to boost your workflow:
|
Extend script/lint-env.mjs with a usage check: every key declared in an
app's committed .env files must be referenced somewhere in the codebase.
A key counts as used when it appears as a word in any tracked file
outside the env directories (source, Docker, CI, deploy manifests) or is
interpolated by another env value ($VAR / ${VAR} / %{VAR}). Keys that are
consumed only by external SDKs/tooling can be exempted via
EXTERNAL_ENV_KEYS.
Remove the dead keys this surfaced (verified unreferenced across the repo;
api has no dynamic process.env access):
- api: AUTH0_ISSUER, WEBSITE_URL (superseded by CORS_WEBSITE_URLS),
DEPLOYMENT_ALLOWANCE_REFILL_THRESHOLD, HEALTHCHECKS_ENABLED
- deploy-web: NEXT_PUBLIC_AUTH0_LOGIN, NEXT_PUBLIC_AUTO_TOP_UP_ENABLED,
NEXT_PUBLIC_BILLING_ENABLED, NEXT_PUBLIC_UNLEASH_FRONTEND_API_URL/TOKEN,
UI_TESTS_TOKEN
- stats-web: NEXT_PUBLIC_UNLEASH_FRONTEND_API_URL/TOKEN
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Follow-up to the unused-key check based on review: - Restore NEXT_PUBLIC_UNLEASH_FRONTEND_API_URL/TOKEN (deploy-web, stats-web) and NEXT_PUBLIC_AUTH0_LOGIN (deploy-web): these are read by @unleash/nextjs and @auth0/nextjs-auth0 via process.env convention, so they never appear as identifiers in source. They are now exempted through EXTERNAL_ENV_KEYS instead of being deleted. - deploy-web: keep NEXT_PUBLIC_GTM_ID in production and add it as an empty value in staging/staging-testnet (rather than dropping it from production) so the pair still declares matching keys. - deploy-web .env.sample: drop the stale UI_TESTS_TOKEN in favour of the already-present E2E_TESTING_CLIENT_TOKEN. - api: remove PORT from the env files; the listen port is provided by the Helm chart (PORT=3000) and the schema still supplies a local default. Still removed as genuinely dead (unreferenced anywhere in the repo): api AUTH0_ISSUER, WEBSITE_URL, DEPLOYMENT_ALLOWANCE_REFILL_THRESHOLD, HEALTHCHECKS_ENABLED; deploy-web NEXT_PUBLIC_AUTO_TOP_UP_ENABLED, NEXT_PUBLIC_BILLING_ENABLED. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
PORT is provided by the Helm chart at runtime, so it stays out of the deployment env files but remains in .env.sample to document the accepted variable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ygrishajev
approved these changes
Jul 21, 2026
stalniy
marked this pull request as draft
July 21, 2026 16:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Closes #1019
What
Add a dotenv-linter based check (script/lint-env.mjs) wired into the per-app CI matrix (reusable-validate-app.yml). For each app it verifies:
Fix the pre-existing violations the check surfaced:
provider-console is temporarily excluded from the layering checks: its base .env holds mainnet defaults duplicated in the overlays and its .env.production is empty, so restructuring its env layering is left to a dedicated follow-up owned by that team.
Summary by CodeRabbit
New Features
npm run lint:envcommand for validating all apps or selected apps.Documentation