Document VITE_* env vars must not be marked secret in Netlify - #3
Merged
Conversation
While verifying the new GH Actions deploy pipeline we discovered the production bundle still shipped with empty VITE_POSTHOG_KEY, VITE_ANALYTICS_*, and VITE_POSTHOG_HOST values. Root cause: all four were flagged as "secret" Netlify env vars, which hides them from the build environment (secret values only reach Functions at request time). Vite reads env at build time only, so the bundle emitted empty strings and silently disabled PostHog analytics in production. Unmark the offending vars at the project level via `netlify env:unset` + `env:set` (no `--secret` flag). This change captures the lesson so future agents do not flag VITE_* vars secret again: - AGENTS.md §3: extends the deploy rules with the source-of-truth split between GH secrets (auth only) and Netlify project env (everything else), plus an explicit rule that VITE_* vars must be regular (non-secret) and a quick audit command. - docs/ARCHITECTURE.md §15.4: adds the same rule and the netlify env:list --plain audit pattern. No code or workflow changes; only docs. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to PRs #1 and #2. Captures the root-cause lesson from this morning's silent analytics regression: the GH Actions deploy pipeline was correct, the Netlify env was misconfigured. All four
VITE_*values (VITE_POSTHOG_KEY,VITE_ANALYTICS_ENABLED,VITE_ANALYTICS_PROVIDER,VITE_POSTHOG_HOST) had been flagged as Netlify "secret" env vars, which hides them from the build environment. Vite reads env at build time only, so the bundle shipped with empty values and PostHog analytics were silently dead in prod.I unmarked them at the project level (
netlify env:unset+netlify env:setwithout--secret); the latest production deploy now bakesSStrVZFix...into the bundle. This PR documents the rule so it does not regress.What changed
AGENTS.md§3 — Production Deploy Pipeline: explicit split between GH repo secrets (auth-only:NETLIFY_AUTH_TOKEN,NETLIFY_SITE_ID,PRODUCTION_DATABASE_URL) and Netlify project env (everything else). New subsection forbidding the--secretflag on anyVITE_*value and giving the audit command.docs/ARCHITECTURE.md§15.4: same rule, captured next to the rest of the pipeline contract so on-call has a single reference.Test plan
curl <bundle> | grep SStrVZFix)netlify env:list --context production --plain | grep '^VITE_'returns unmasked valuesMade with Cursor