[wrangler] Add analytics properties to secret commands (#11777)

MattieTK · web-flow · commit 69979a3e0c20 · 2026-01-05T15:21:26.000Z
* Add analytics properties to secret commands

* fix: rename shadowed variable to fix eslint no-shadow error
diff --git a/.changeset/secret-analytics-events.md b/.changeset/secret-analytics-events.md
@@ -0,0 +1,14 @@
+---
+"wrangler": patch
+---
+
+Add analytics properties to secret commands for better usage insights
+
+Secret commands (`wrangler secret put`, `wrangler secret bulk`, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
+
+- `secretOperation`: Whether this is a "single" or "bulk" secret operation
+- `secretSource`: How the secret was provided ("interactive", "stdin", or "file")
+- `secretFormat`: For bulk operations, the format used ("json" or "dotenv")
+- `hasEnvironment`: Whether an environment was specified
+
+These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
diff --git a/packages/wrangler/src/pages/secret/index.ts b/packages/wrangler/src/pages/secret/index.ts
@@ -175,9 +175,17 @@ export const pagesSecretPutCommand = createCommand({
 			}
 		);
 
-		metrics.sendMetricsEvent("create pages encrypted variable", {
-			sendMetrics: config?.send_metrics,
-		});
+		metrics.sendMetricsEvent(
+			"create pages encrypted variable",
+			{
+				secretOperation: "single",
+				secretSource: isInteractive() ? "interactive" : "stdin",
+				hasEnvironment: Boolean(args.env),
+			},
+			{
+				sendMetrics: config?.send_metrics,
+			}
+		);
 
 		logger.log(`✨ Success! Uploaded secret ${args.key}`);
 	},
@@ -206,20 +214,22 @@ export const pagesSecretBulkCommand = createCommand({
 	},
 	positionalArgs: ["file"],
 	async handler(args) {
-		const { env, project, accountId } = await pagesProject(
+		const { env, project, accountId, config } = await pagesProject(
 			args.env,
 			args.projectName
 		);
 
 		logger.log(
 			`🌀 Creating the secrets for the Pages project "${project.name}" (${env})`
 		);
-		const content = await parseBulkInputToObject(args.file);
+		const result = await parseBulkInputToObject(args.file);
 
-		if (!content) {
+		if (!result) {
 			throw new FatalError(`🚨 No content found in file or piped input.`);
 		}
 
+		const { content, secretSource, secretFormat } = result;
+
 		const upsertBindings = Object.fromEntries(
 			Object.entries(content).map(([key, value]) => {
 				return [
@@ -254,6 +264,18 @@ export const pagesSecretBulkCommand = createCommand({
 			logger.log(
 				`✨ ${Object.keys(upsertBindings).length} secrets successfully uploaded`
 			);
+			metrics.sendMetricsEvent(
+				"create pages encrypted variable",
+				{
+					secretOperation: "bulk",
+					secretSource,
+					secretFormat,
+					hasEnvironment: Boolean(args.env),
+				},
+				{
+					sendMetrics: config?.send_metrics,
+				}
+			);
 		} catch (err) {
 			logger.log(`🚨 Secrets failed to upload`);
 			throw err;
diff --git a/packages/wrangler/src/secret/index.ts b/packages/wrangler/src/secret/index.ts
@@ -229,9 +229,17 @@ export const secretPutCommand = createCommand({
 
 		try {
 			await submitSecret();
-			metrics.sendMetricsEvent("create encrypted variable", {
-				sendMetrics: config.send_metrics,
-			});
+			metrics.sendMetricsEvent(
+				"create encrypted variable",
+				{
+					secretOperation: "single",
+					secretSource: isInteractive ? "interactive" : "stdin",
+					hasEnvironment: Boolean(args.env),
+				},
+				{
+					sendMetrics: config.send_metrics,
+				}
+			);
 		} catch (e) {
 			if (isWorkerNotFoundError(e)) {
 				// create a draft worker and try again
@@ -449,12 +457,14 @@ export const secretBulkCommand = createCommand({
 			}`
 		);
 
-		const content = await parseBulkInputToObject(args.file);
+		const result = await parseBulkInputToObject(args.file);
 
-		if (!content) {
+		if (!result) {
 			return logger.error(`🚨 No content found in file, or piped input.`);
 		}
 
+		const { content, secretSource, secretFormat } = result;
+
 		function getSettings() {
 			const url = isServiceEnv
 				? `/accounts/${accountId}/workers/services/${scriptName}/environments/${args.env}/settings`
@@ -487,13 +497,13 @@ export const secretBulkCommand = createCommand({
 		} catch (e) {
 			if (isWorkerNotFoundError(e)) {
 				// create a draft worker before patching
-				const result = await createDraftWorker({
+				const draftWorkerResult = await createDraftWorker({
 					config,
 					args: args,
 					accountId,
 					scriptName,
 				});
-				if (result === null) {
+				if (draftWorkerResult === null) {
 					return;
 				}
 				existingBindings = [];
@@ -534,6 +544,18 @@ export const secretBulkCommand = createCommand({
 			logger.log("");
 			logger.log("Finished processing secrets file:");
 			logger.log(`✨ ${upsertBindings.length} secrets successfully uploaded`);
+			metrics.sendMetricsEvent(
+				"create encrypted variable",
+				{
+					secretOperation: "bulk",
+					secretSource,
+					secretFormat,
+					hasEnvironment: Boolean(args.env),
+				},
+				{
+					sendMetrics: config.send_metrics,
+				}
+			);
 		} catch (err) {
 			logger.log("");
 			logger.log(`🚨 Secrets failed to upload`);
@@ -561,16 +583,39 @@ export function validateFileSecrets(
 	}
 }
 
-export async function parseBulkInputToObject(input?: string) {
+/** Error thrown when no input is provided to parseBulkInputToObject */
+export class NoInputError extends Error {
+	constructor() {
+		super("No input provided");
+		this.name = "NoInputError";
+	}
+}
+
+/** Result from parsing bulk secret input, including metadata for analytics */
+export type BulkInputResult = {
+	content: Record<string, string>;
+	secretSource: "file" | "stdin";
+	secretFormat: "json" | "dotenv";
+};
+
+export async function parseBulkInputToObject(
+	input?: string
+): Promise<BulkInputResult | undefined> {
 	let content: Record<string, string>;
+	let secretSource: "file" | "stdin";
+	let secretFormat: "json" | "dotenv";
+
 	if (input) {
+		secretSource = "file";
 		const jsonFilePath = path.resolve(input);
 		try {
 			const fileContent = readFileSync(jsonFilePath);
 			try {
 				content = parseJSON(fileContent) as Record<string, string>;
+				secretFormat = "json";
 			} catch (e) {
 				content = dotenvParse(fileContent);
+				secretFormat = "dotenv";
 				// dotenvParse does not error unless fileContent is undefined, no keys === error
 				if (Object.keys(content).length === 0) {
 					throw e;
@@ -583,6 +628,7 @@ export async function parseBulkInputToObject(input?: string) {
 		}
 		validateFileSecrets(content, input);
 	} else {
+		secretSource = "stdin";
 		try {
 			const rl = readline.createInterface({ input: process.stdin });
 			let pipedInput = "";
@@ -591,8 +637,10 @@ export async function parseBulkInputToObject(input?: string) {
 			}
 			try {
 				content = parseJSON(pipedInput) as Record<string, string>;
+				secretFormat = "json";
 			} catch (e) {
 				content = dotenvParse(pipedInput);
+				secretFormat = "dotenv";
 				// dotenvParse does not error unless fileContent is undefined, no keys === error
 				if (Object.keys(content).length === 0) {
 					throw e;
@@ -602,5 +650,5 @@ export async function parseBulkInputToObject(input?: string) {
 			return;
 		}
 	}
-	return content;
+	return { content, secretSource, secretFormat };
 }
diff --git a/packages/wrangler/src/versions/secrets/bulk.ts b/packages/wrangler/src/versions/secrets/bulk.ts
@@ -2,6 +2,7 @@ import { configFileName, UserError } from "@cloudflare/workers-utils";
 import { fetchResult } from "../../cfetch";
 import { createCommand } from "../../core/create-command";
 import { logger } from "../../logger";
+import * as metrics from "../../metrics";
 import { parseBulkInputToObject } from "../../secret";
 import { requireAuth } from "../../user";
 import { getLegacyScriptName } from "../../utils/getLegacyScriptName";
@@ -54,12 +55,14 @@ export const versionsSecretBulkCommand = createCommand({
 			`🌀 Creating the secrets for the Worker "${scriptName}" ${args.env ? `(${args.env})` : ""}`
 		);
 
-		const content = await parseBulkInputToObject(args.file);
+		const result = await parseBulkInputToObject(args.file);
 
-		if (!content) {
+		if (!result) {
 			return logger.error(`No content found in file or piped input.`);
 		}
 
+		const { content, secretSource, secretFormat } = result;
+
 		const secrets = Object.entries(content).map(([key, value]) => ({
 			name: key,
 			value,
@@ -94,6 +97,20 @@ export const versionsSecretBulkCommand = createCommand({
 		for (const secret of secrets) {
 			logger.log(`✨ Successfully created secret for key: ${secret.name}`);
 		}
+
+		metrics.sendMetricsEvent(
+			"create encrypted variable",
+			{
+				secretOperation: "bulk",
+				secretSource,
+				secretFormat,
+				hasEnvironment: Boolean(args.env),
+			},
+			{
+				sendMetrics: config.send_metrics,
+			}
+		);
+
 		logger.log(
 			`✨ Success! Created version ${newVersion.id} with ${secrets.length} secrets.` +
 				`\n➡️  To deploy this version to production traffic use the command "wrangler versions deploy".`
diff --git a/packages/wrangler/src/versions/secrets/put.ts b/packages/wrangler/src/versions/secrets/put.ts
@@ -3,6 +3,7 @@ import { fetchResult } from "../../cfetch";
 import { createCommand } from "../../core/create-command";
 import { prompt } from "../../dialogs";
 import { logger } from "../../logger";
+import * as metrics from "../../metrics";
 import { requireAuth } from "../../user";
 import { getLegacyScriptName } from "../../utils/getLegacyScriptName";
 import { readFromStdin, trimTrailingWhitespace } from "../../utils/std";
@@ -95,6 +96,18 @@ export const versionsSecretPutCommand = createCommand({
 			unsafeMetadata: config.unsafe.metadata,
 		});
 
+		metrics.sendMetricsEvent(
+			"create encrypted variable",
+			{
+				secretOperation: "single",
+				secretSource: isInteractive ? "interactive" : "stdin",
+				hasEnvironment: Boolean(args.env),
+			},
+			{
+				sendMetrics: config.send_metrics,
+			}
+		);
+
 		logger.log(
 			`✨ Success! Created version ${newVersion.id} with secret ${args.key}.` +
 				`\n➡️  To deploy this version with secret ${args.key} to production traffic use the command "wrangler versions deploy".`
