feat: populate NETLIFY_SKEW_PROTECTION_TOKEN

packages/build/src/core/flags.js

@@ -76,6 +76,11 @@ Default: automatically guessed`,
     describe: `Netlify Build ID.
 Default: automatically guessed`,
   },
+  skewProtectionToken: {
+    string: true,
+    describe: `Netlify Skew Protection token.`,
+    hidden: true,
+  },
   context: {
     string: true,
     describe: `Build context.

packages/build/src/core/normalize_flags.ts

@@ -87,6 +87,7 @@ const getDefaultFlags = function ({ env: envOpt = {} }, combinedEnv) {
     edgeFunctionsDistDir: DEFAULT_EDGE_FUNCTIONS_DIST,
     cacheDir: DEFAULT_CACHE_DIR,
     deployId: combinedEnv.DEPLOY_ID,
+    skewProtectionToken: combinedEnv.NETLIFY_SKEW_PROTECTION_TOKEN,
     buildId: combinedEnv.BUILD_ID,
     debug: Boolean(combinedEnv.NETLIFY_BUILD_DEBUG),
     bugsnagKey: combinedEnv.BUGSNAG_KEY,

packages/build/src/core/types.ts

@@ -10,6 +10,8 @@ export type BuildCLIFlags = {
   token: string
   /** Netlify Deploy ID */
   deployId: string
+  /** Netlify Skew Protection token */
+  skewProtectionToken?: string
   /**
    * Run in dry mode, i.e. printing steps without executing them
    * @default false

packages/config/src/env/main.ts

@@ -21,6 +21,7 @@ export const getEnv = async function ({
   buildDir,
   branch,
   deployId,
+  skewProtectionToken,
   buildId,
   context,
   cachedEnv,
@@ -30,7 +31,15 @@ export const getEnv = async function ({
   }
 
   const internalEnv = getInternalEnv(cachedEnv)
-  const generalEnv = await getGeneralEnv({ siteInfo, buildDir, branch, deployId, buildId, context })
+  const generalEnv = await getGeneralEnv({
+    siteInfo,
+    buildDir,
+    branch,
+    deployId,
+    skewProtectionToken,
+    buildId,
+    context,
+  })
   const [accountEnv, uiEnv, configFileEnv] = await getUserEnv({
     api,
     config,
@@ -95,6 +104,7 @@ const getGeneralEnv = async function ({
   buildDir,
   branch,
   deployId,
+  skewProtectionToken,
   buildId,
   context,
 }) {
@@ -104,6 +114,7 @@ const getGeneralEnv = async function ({
     SITE_ID: id,
     SITE_NAME: name,
     DEPLOY_ID: deployId,
+    NETLIFY_SKEW_PROTECTION_TOKEN: skewProtectionToken,
     BUILD_ID: buildId,
     ACCOUNT_ID: accountId,
     ...deployUrls,

packages/config/src/main.ts

@@ -92,6 +92,7 @@ export const resolveConfig = async function (opts): Promise<Config> {
     siteId,
     accountId,
     deployId,
+    skewProtectionToken,
     buildId,
     baseRelDir,
     mode,
@@ -163,6 +164,7 @@ export const resolveConfig = async function (opts): Promise<Config> {
     buildDir,
     branch,
     deployId,
+    skewProtectionToken,
     buildId,
     context,
     cachedEnv: parsedCachedConfig?.env || {},

packages/config/src/options/main.js

@@ -45,6 +45,7 @@ const getDefaultOpts = function ({ env: envOpt = {}, cwd: cwdOpt, defaultConfig
     token: combinedEnv.NETLIFY_AUTH_TOKEN,
     siteId: combinedEnv.NETLIFY_SITE_ID,
     deployId: combinedEnv.DEPLOY_ID || DEFAULT_DEPLOY_ID,
+    skewProtectionToken: combinedEnv.NETLIFY_SKEW_PROTECTION_TOKEN,
     buildId: combinedEnv.BUILD_ID || DEFAULT_BUILD_ID,
     mode: 'require',
     offline: false,

packages/config/tests/env/tests.js

@@ -254,6 +254,21 @@ test('Sets default BUILD_ID environment variable', async (t) => {
   t.is(BUILD_ID.value, '0')
 })
 
+test('Sets NETLIFY_SKEW_PROTECTION_TOKEN environment variable', async (t) => {
+  const {
+    env: { NETLIFY_SKEW_PROTECTION_TOKEN },
+  } = await new Fixture('./fixtures/empty').withFlags({ skewProtectionToken: 'test-token' }).runWithConfigAsObject()
+  t.deepEqual(NETLIFY_SKEW_PROTECTION_TOKEN.sources, ['general'])
+  t.is(NETLIFY_SKEW_PROTECTION_TOKEN.value, 'test-token')
+})
+
+test('Does not set NETLIFY_SKEW_PROTECTION_TOKEN environment variable if no flag is provided', async (t) => {
+  const {
+    env: { NETLIFY_SKEW_PROTECTION_TOKEN },
+  } = await new Fixture('./fixtures/empty').runWithConfigAsObject()
+  t.is(NETLIFY_SKEW_PROTECTION_TOKEN, undefined)
+})
+
 test('Sets SITE_ID environment variable', async (t) => {
   const {
     env: { SITE_ID },