Prevent secrets/env vars from being deleted when deploying via GitHub integration

[dconroy]

Which Cloudflare product(s) does this pertain to?

Workers Runtime

What versions & operating system are you using?

No local wrangler

Please provide a link to a minimal reproduction

No response

Describe the Bug

Hi team,

I'm using the GitHub <-> Cloudflare connector configured via the Cloudflare dashboard (not GitHub Actions) to deploy my Worker. I’ve noticed that any environment variables or secrets I define through the Cloudflare UI are deleted with each deployment.

My situation:

I want to avoid saving secrets in source control.

I'm not using GitHub Actions — just the built-in GitHub integration in the Cloudflare UI.

I’m adding environment variables in the dashboard manually, but they disappear every time I push to the connected branch.

Issue: Every deployment from GitHub seems to overwrite or clear out previously set environment variables, even though I haven't changed anything related to them in the repo. This makes it nearly impossible to manage secrets securely without re-entering them after every deploy.

Request:

Is there a way to retain environment variables set in the dashboard when using the GitHub integration?

Can you clarify whether this is expected behavior or a bug?

Are there any options to separate secret/config management from deploy behavior when not using GitHub Actions?

I’d prefer not to manage secrets in wrangler.toml or commit them anywhere in version control. I’d also rather not shift to GitHub Actions just to preserve environment variables.

Thanks in advance!

Please provide any relevant error logs

No response

[penalosa]

There are two related concepts here, and Wrangler treats both differently. If you set a Secret in the dashboard (encrypted environment variable) it will be preserved across deploys, and should not be added to source control.

On the other hand, in general we recommend adding environment variables to your Wrangler configuration file so that they're managed and tracked in source control. That said, you can enable the keep_vars setting in your Wrangler configuration file to stop Wrangler from interfering with environment variables you set in the dash.

[lrapoport-cf]

hi @dconroy :) please see @penalosa 's comment and let us know if you still have an open question. otherwise we'll consider the issue closed :)

[andy-clapham]

we recommend adding environment variables to your Wrangler configuration file so that they're managed and tracked in source control

That seems a bit odd - source is not environment. And I wouldn't put secrets there too.
Anway thanks for the keep_vars tip, that's what I came here looking for.

[komposer-aml]

@andy-clapham I was confused too. I think he was trying to say publishable keys go in wrangler.toml and secret keys persist after being set in the Cloudflare UI.

If you set a Secret in the dashboard (encrypted environment variable) it will be preserved across deploys, and should not be added to source control.

[homerjam]

keep_vars should on by default I reckon

[kirapwn]

Why when using keep_vars it still removed the envs? also secret ones too…

[kirapwn]

for me it seems that the wrangler versions upload is removing the env variables on the worker. Even if they are secret ones ( removed for me half of them). This seems to me unintentional and a major issue when using previews with the same worker.
I do not want to keep variables in git repository, but keep_vars is not allowed for versions upload that kills the use case that this can be used imo...

Should be able to set a variables like PREVIEW_MYVARIABLE, so they are used for preview deploys, currently this workflow is broken