From 081b0e6b54342eee2e723d6266a7f5e2d18acb4e Mon Sep 17 00:00:00 2001
From: Chris Arderne <chris@trigger.dev>
Date: Tue, 28 Jul 2026 14:29:57 +0100
Subject: [PATCH] fix(cli): redact environment values from build debug logs

---
 .changeset/silent-build-logs.md               |  5 +++
 packages/cli-v3/src/build/buildWorker.ts      |  7 ++--
 .../src/build/buildWorkerLogging.test.ts      | 35 +++++++++++++++++++
 .../cli-v3/src/build/buildWorkerLogging.ts    | 21 +++++++++++
 4 files changed, 64 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/silent-build-logs.md
 create mode 100644 packages/cli-v3/src/build/buildWorkerLogging.test.ts
 create mode 100644 packages/cli-v3/src/build/buildWorkerLogging.ts

diff --git a/.changeset/silent-build-logs.md b/.changeset/silent-build-logs.md
new file mode 100644
index 00000000000..17c3b9ab0f3
--- /dev/null
+++ b/.changeset/silent-build-logs.md
@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Prevent build debug logs from including environment variable values.
diff --git a/packages/cli-v3/src/build/buildWorker.ts b/packages/cli-v3/src/build/buildWorker.ts
index c3e1641ade1..fc199142492 100644
--- a/packages/cli-v3/src/build/buildWorker.ts
+++ b/packages/cli-v3/src/build/buildWorker.ts
@@ -15,11 +15,12 @@ import { join, relative, sep } from "node:path";
 import { generateContainerfile } from "../deploy/buildImage.js";
 import { writeFile } from "node:fs/promises";
 import { buildManifestToJSON } from "../utilities/buildManifest.js";
+import { logger } from "../utilities/logger.js";
 import { readPackageJSON } from "pkg-types";
 import { writeJSONFile } from "../utilities/fileSystem.js";
 import { isWindows } from "std-env";
 import { pathToFileURL } from "node:url";
-import { logger } from "../utilities/logger.js";
+import { logBuildWorkerStart } from "./buildWorkerLogging.js";
 import { SdkVersionExtractor } from "./plugins.js";
 import { spinner } from "../utilities/windows.js";
 
@@ -42,9 +43,7 @@ export type BuildWorkerOptions = {
 };
 
 export async function buildWorker(options: BuildWorkerOptions) {
-  logger.debug("Starting buildWorker", {
-    options,
-  });
+  logBuildWorkerStart(options);
 
   const resolvedConfig = options.resolvedConfig;
 
diff --git a/packages/cli-v3/src/build/buildWorkerLogging.test.ts b/packages/cli-v3/src/build/buildWorkerLogging.test.ts
new file mode 100644
index 00000000000..8b5f5827f5f
--- /dev/null
+++ b/packages/cli-v3/src/build/buildWorkerLogging.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it, vi } from "vitest";
+import { logBuildWorkerStart } from "./buildWorkerLogging.js";
+import { logger } from "../utilities/logger.js";
+
+const secret = "build-worker-secret-value";
+
+describe("logBuildWorkerStart", () => {
+  it.each(["deploy", "unmanaged"] as const)(
+    "does not log environment values for %s builds",
+    (target) => {
+      const debug = vi.spyOn(logger, "debug").mockImplementation(() => {});
+
+      logBuildWorkerStart({
+        target,
+        branch: "main",
+        envVars: { BUILD_SECRET: secret },
+        rewritePaths: true,
+        forcedExternals: ["example-package"],
+      });
+
+      expect(debug).toHaveBeenCalledOnce();
+      expect(JSON.stringify(debug.mock.calls)).not.toContain(secret);
+      expect(debug).toHaveBeenCalledWith("Starting buildWorker", {
+        target,
+        hasBranch: true,
+        envVarCount: 1,
+        rewritePaths: true,
+        forcedExternalsCount: 1,
+        plain: false,
+      });
+
+      debug.mockRestore();
+    }
+  );
+});
diff --git a/packages/cli-v3/src/build/buildWorkerLogging.ts b/packages/cli-v3/src/build/buildWorkerLogging.ts
new file mode 100644
index 00000000000..867c8df31a2
--- /dev/null
+++ b/packages/cli-v3/src/build/buildWorkerLogging.ts
@@ -0,0 +1,21 @@
+import { logger } from "../utilities/logger.js";
+
+type BuildWorkerLogOptions = {
+  target: string;
+  branch?: string;
+  envVars?: Record<string, string>;
+  rewritePaths?: boolean;
+  forcedExternals?: string[];
+  plain?: boolean;
+};
+
+export function logBuildWorkerStart(options: BuildWorkerLogOptions) {
+  logger.debug("Starting buildWorker", {
+    target: options.target,
+    hasBranch: options.branch !== undefined,
+    envVarCount: Object.keys(options.envVars ?? {}).length,
+    rewritePaths: options.rewritePaths ?? false,
+    forcedExternalsCount: options.forcedExternals?.length ?? 0,
+    plain: options.plain ?? false,
+  });
+}