fix #20675 by adding an esbuild plugin to inject env variables

[ndelangen]

Issue: #20675

add an esbuild plugin to the builder-manager that injects environment variables

[socket-security]

Socket Security Pull Request Report

👍 No dependency changes detected in pull request

Pull request report summary

Issue	Status
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Shell access	✅ 0 issues
Uses eval	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
GitHub dependency	✅ 0 issues
New author	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues
AI detected malware	✅ 0 issues

Powered by socket.dev

[ndelangen]

esbuild-plugin-environment should be using [email protected] instead of [email protected]

🤔

@webdeveric I'm trying to use your package: https://github.com/webdeveric/esbuild-plugin-environment/blob/master/package.json
But it's giving me the above listed error in CI. Do you have any advice for me?
It seems related to:
https://github.com/webdeveric/esbuild-plugin-environment/blob/master/package.json#L27

[webdeveric]

@ndelangen The check-package-manager cli just ensures the correct package manager is being used in the project. It should skip running if it detects that it is being called from a dependency. Perhaps there is an edge case I missed.

Can you rerun the failed GH Action with debug logging turned on? check-package-manager recognizes that debug logging is on and will print out debug messages.

[IanVS]

Hah, of course it passed as soon as I enabled debug mode... Going to try running them all again without, to see if debug actually makes it pass.

[webdeveric]

@IanVS I made some fixes to check-package-manager that resolved the issue on Windows. I'm using npx to call the cli so it'll always get the latest version, which is why it is passing now for you.

[webdeveric]

I published version 0.2.3 of this plugin.
If you update to that version, you will get rid of some transitive dependencies.

[ndelangen]

We should QA that this feature actually does what we intent it should do.

[ndelangen]

@webdeveric I ended up using the define property instead, after local testing, it seemed the plugin wasn't replacing references in the code.

I do very much appreciate the support you've given. ❤️

[webdeveric]

@ndelangen If you have a reproducible bug, please open an issue and I'll take a look.

But on first glance, it looks like you were calling JSON.stringify when you didn't need to.
My plugin does that for you.

environmentPlugin({
  ...stringifyProcessEnvs(envs),
  NODE_ENV: JSON.stringify(process.env.NODE_ENV),
}),

Should have been (untested)

environmentPlugin(envs),
environmentPlugin(['NODE_ENV']),

[ndelangen]

Ow, I needed to invoke the plugin twice? once with the object and once with the keys?

I just assumed those were 2 separate use-cases.

[webdeveric]

@ndelangen They are different use cases, one for user provided default values, and the other (array of keys) uses empty string as the default.

I was just removing the JSON.stringify from your code in my example above.

[IanVS]

Did you mean to leave these console.log statements here, @ndelangen ?

[ndelangen]

I did not 😨