[wrangler] feat: add --secrets-file parameter to deploy and versions upload by devin-ai-integration[bot] · Pull Request #10896 · cloudflare/workers-sdk

devin-ai-integration · 2025-10-07T11:01:04Z

Adds a --secrets-file parameter to both wrangler deploy and wrangler versions upload, allowing secrets to be uploaded alongside Worker code in a single operation.

Changes

New CLI option: --secrets-file <path>

Both commands accept a path to a JSON or .env file containing secrets. The file is parsed using the existing parseBulkInputToObject() from the secrets module (same parser used by wrangler versions secret bulk).

wrangler deploy --secrets-file .env.production
wrangler versions upload --secrets-file secrets.json

Implementation details:

Secrets are added to the bindings map as secret_text entries (deploy/deploy.ts, versions/upload.ts)
wrangler deploy: sets keepSecrets: true when --secrets-file is provided (or when --keep-vars is set), so existing secrets not in the file are preserved
wrangler versions upload: keepSecrets remains unconditionally true (existing behavior — secrets are always inherited)
The help text for --secrets-file cross-references --keep-secrets for discoverability

Files changed:

File	Change
`packages/wrangler/src/deploy/index.ts`	Register `--secrets-file` option
`packages/wrangler/src/deploy/deploy.ts`	Parse secrets file, add to bindings, set `keepSecrets`
`packages/wrangler/src/versions/upload.ts`	Register `--secrets-file` option, parse secrets file, add to bindings
`packages/wrangler/src/__tests__/deploy/secrets.test.ts`	5 tests for `deploy --secrets-file`
`packages/wrangler/src/__tests__/versions/upload.test.ts`	6 tests for `versions upload --secrets-file`
`.changeset/secrets-file-versions-upload.md`	Minor changeset

Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because:
Public documentation
- Cloudflare docs PR(s): docs: add --secrets-file documentation for wrangler deploy and versions upload cloudflare-docs#28976
- Documentation not necessary because:

devin-ai-integration · 2025-10-07T11:01:06Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

changeset-bot · 2025-10-07T11:01:08Z

🦋 Changeset detected

Latest commit: ce22602

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2025-10-07T11:03:28Z

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@10896

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@10896

miniflare

npm i https://pkg.pr.new/miniflare@10896

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@10896

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@10896

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@10896

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@10896

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@10896

wrangler

npm i https://pkg.pr.new/wrangler@10896

commit: 649f618

packages/wrangler/src/versions/upload.ts

devin-ai-integration · 2025-10-07T13:37:07Z

Fixed! I've restored the comment in commit 710a08c.

The comment is now back on line 753:

logpush: undefined, // both logpush and observability are not supported in versions upload

All local tests pass. There are 2 macOS test failures in CI, but they appear to be unrelated flaky tests since my change only restored a comment.

packages/wrangler/src/versions/upload.ts

devin-ai-integration · 2025-10-07T16:17:44Z

Fixed! I've updated the logic to always set keepSecrets: true and removed the keepBindings assignment. The secrets file is now additive - secrets from the file are added/updated while existing secrets are inherited from the previous version, matching the behavior of wrangler versions secret bulk.

Changes in commit 93e74d6:

keepSecrets is now always true (line 731 in upload.ts)
Removed the conditional logic and keepBindings assignment
createWorkerUploadForm() automatically adds ["secret_text", "secret_key"] to keep_bindings when keepSecrets: true
Updated test expectations to match the correct binding order

This ensures that secrets not included in the file will be inherited from the previous version, making the secrets file truly additive.

petebacondarwin · 2025-11-13T14:59:12Z

Can you rebase and fix the conflicts here?

devin-ai-integration · 2025-11-13T14:59:16Z

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

theoephraim · 2025-12-02T23:34:11Z

Happy to see this moving along and that you included the functionality for wrangler deploy as well.

One important request - I'm feeding in secrets from another tool and would like to avoid writing anything to disk. Is there a way to accept the secrets content as a long string or to feed in on stdin like secret bulk? The stdin way is a bit awkward since the command is much more general now...

This would allow passing them as wrangler deploy --secrets $(fetch-and-spit-out-secrets)

@petebacondarwin - any update on timeline for this to land? It will greatly simplify things for using Varlock with Cloudflare secrets

penalosa · 2026-01-27T14:41:47Z

This is an old PR that's quite stale so I'm going to close it for now. If you'd still like to land it feel free to re-open and get it back up to date with main.

theoephraim · 2026-02-12T07:52:45Z

@penalosa @petebacondarwin - would really love to see this single step "deploy with secrets" functionality land. Anything I can do to help? I expect you're likely not taking external PRs much these days?

petebacondarwin · 2026-02-19T11:49:32Z

Re-opening as I would like to try landing this.
It is not clear how best one could implement not writing the secrets to disk so I am going to land without that initially and then we can discuss how best one could achieve that.

github-actions · 2026-03-12T15:03:00Z

✅ All changesets look good

packages/wrangler/src/deploy/index.ts

Co-Authored-By: pbacondarwin@cloudflare.com <pete@bacondarwin.com>

- Set keepSecrets: true unconditionally (regardless of secretsFile) - Remove keepBindings assignment when secretsFile is provided - createWorkerUploadForm() automatically adds keep_bindings when keepSecrets is true - Secrets from file are now additive to existing secrets (matching versions secret bulk behavior) - Update tests to expect correct keep_bindings order: ['secret_text', 'secret_key'] Co-Authored-By: pbacondarwin@cloudflare.com <pete@bacondarwin.com>

- Add --secrets-file argument to deploy command options - Parse secrets file and add to rawBindings in deploy implementation - Set keepSecrets: true to inherit existing secrets (additive behavior) - Add comprehensive unit tests for deploy with secrets file - Update changeset to document both deploy and versions upload commands Co-Authored-By: pbacondarwin@cloudflare.com <pete@bacondarwin.com>

- Set keepSecrets based on keepVars OR secretsFile (not unconditional) - Remove incorrect test that expected keepSecrets=true by default - Preserves backward compatibility while enabling --secrets-file feature Co-Authored-By: pbacondarwin@cloudflare.com <pete@bacondarwin.com>

Co-Authored-By: pbacondarwin@cloudflare.com <pete@bacondarwin.com>

…ctored API - Create __tests__/deploy/secrets.test.ts with 5 tests for --secrets-file - Fix deploy.ts to add secrets to the bindings map instead of rawBindings, since createWorkerUploadForm now Omits rawBindings from CfWorkerInit - Remove unused WorkerMetadataBinding import from deploy.ts

Apply the same fix as deploy.ts — add secrets to the bindings map instead of setting rawBindings on CfWorkerInit, which no longer has that property after the main branch refactor.

Use captureRequestsFrom() to capture requests and assert on them after runWrangler() completes, instead of placing expect() calls inside MSW handlers. Also destructure expect from test context per wrangler conventions.

workers-devprod · 2026-03-13T13:17:18Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

dario-piotrowicz

Generally looks good to me 🙂

I've just left some minor non-blocking comments.

Also one question I have, could/should we support multiple secret files as well?
e.g.

wrangler deploy --secrets-file env.base --secrets-file .env.production

packages/wrangler/src/__tests__/deploy/secrets.test.ts

packages/wrangler/src/deploy/deploy.ts

packages/wrangler/src/__tests__/versions/upload.test.ts

workers-devprod added this to workers-sdk Oct 7, 2025

github-project-automation bot moved this to Untriaged in workers-sdk Oct 7, 2025

devin-ai-integration bot marked this pull request as ready for review October 7, 2025 12:57

devin-ai-integration bot requested a review from a team as a code owner October 7, 2025 12:57

petebacondarwin reviewed Oct 7, 2025

View reviewed changes

packages/wrangler/src/versions/upload.ts Outdated Show resolved Hide resolved

petebacondarwin reviewed Oct 7, 2025

View reviewed changes

packages/wrangler/src/versions/upload.ts Outdated Show resolved Hide resolved

petebacondarwin mentioned this pull request Oct 27, 2025

Add a --secret arg like the --var arg #11109

Closed

devin-ai-integration bot force-pushed the devin/1759833405-secrets-file-versions-upload branch from 3f78336 to 0de7764 Compare October 29, 2025 08:53

petebacondarwin marked this pull request as draft November 13, 2025 14:59

devin-ai-integration bot force-pushed the devin/1759833405-secrets-file-versions-upload branch from 0de7764 to 4f6b593 Compare November 13, 2025 15:18

theoephraim mentioned this pull request Dec 4, 2025

wrangler versions commands are tricky to automate because of IDs #11528

Closed

penalosa closed this Jan 27, 2026

github-project-automation bot moved this from Untriaged to Done in workers-sdk Jan 27, 2026

petebacondarwin reopened this Feb 19, 2026

github-project-automation bot moved this from Done to Untriaged in workers-sdk Feb 19, 2026

petebacondarwin force-pushed the devin/1759833405-secrets-file-versions-upload branch from fc2aa9e to 0c8e830 Compare March 12, 2026 15:02

petebacondarwin force-pushed the devin/1759833405-secrets-file-versions-upload branch from f242028 to 6e255bf Compare March 13, 2026 10:00

petebacondarwin reviewed Mar 13, 2026

View reviewed changes

packages/wrangler/src/deploy/index.ts Outdated Show resolved Hide resolved

devin-ai-integration bot and others added 9 commits March 13, 2026 13:16

feat: add --secrets-file parameter to wrangler versions upload

7d97133

Co-Authored-By: pbacondarwin@cloudflare.com <pete@bacondarwin.com>

chore: apply prettier formatting

5486d8c

Co-Authored-By: pbacondarwin@cloudflare.com <pete@bacondarwin.com>

fix: use bindings map instead of rawBindings in versions upload

6269874

Apply the same fix as deploy.ts — add secrets to the bindings map instead of setting rawBindings on CfWorkerInit, which no longer has that property after the main branch refactor.

refactor: move assertions out of MSW handlers in upload.test.ts

ef3bcc1

Use captureRequestsFrom() to capture requests and assert on them after runWrangler() completes, instead of placing expect() calls inside MSW handlers. Also destructure expect from test context per wrangler conventions.

fix: mention --keep-secrets in --secrets-file help description

e13be2a

petebacondarwin force-pushed the devin/1759833405-secrets-file-versions-upload branch from b1ebbdf to e13be2a Compare March 13, 2026 13:16

petebacondarwin marked this pull request as ready for review March 13, 2026 13:16

petebacondarwin changed the title ~~feat: add --secrets-file parameter to wrangler versions upload~~ [wrangler] feat: add --secrets-file parameter to deploy and versions upload Mar 13, 2026

devin-ai-integration bot commented Mar 13, 2026

View reviewed changes

dario-piotrowicz approved these changes Mar 13, 2026

View reviewed changes

packages/wrangler/src/__tests__/deploy/secrets.test.ts Outdated Show resolved Hide resolved

packages/wrangler/src/deploy/deploy.ts Show resolved Hide resolved

packages/wrangler/src/__tests__/versions/upload.test.ts Outdated Show resolved Hide resolved

github-project-automation bot moved this from Untriaged to Approved in workers-sdk Mar 13, 2026

fixup expect usage

7cca582

petebacondarwin mentioned this pull request Mar 13, 2026

docs: add --secrets-file documentation for wrangler deploy and versions upload cloudflare/cloudflare-docs#28976

Open

5 tasks

fixup tests including error messages for loading bulk secrets files

b2f3c57

This comment was marked as resolved.

Sign in to view

petebacondarwin added 2 commits March 13, 2026 16:10

fix error string

a1bcb86

fix formatting

ce22602

petebacondarwin merged commit 351e1e1 into main Mar 13, 2026
35 checks passed

petebacondarwin deleted the devin/1759833405-secrets-file-versions-upload branch March 13, 2026 17:01

github-project-automation bot moved this from Approved to Done in workers-sdk Mar 13, 2026

workers-devprod mentioned this pull request Mar 13, 2026

Version Packages #12876

Merged

This was referenced Mar 31, 2026

🚀 Feature Request: Ability to upload secrets with Worker script contents #6449

Closed

Support Environment Variables/Secrets in wrangler versions upload #10068

Closed

Feature request: wrangler deploy should optionally auto-sync secrets #11719

Closed

Conversation

devin-ai-integration bot commented Oct 7, 2025 • edited by petebacondarwin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

devin-ai-integration bot commented Oct 7, 2025

🤖 Devin AI Engineer

Uh oh!

changeset-bot bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot commented Oct 7, 2025

Uh oh!

Uh oh!

devin-ai-integration bot commented Oct 7, 2025

Uh oh!

petebacondarwin commented Nov 13, 2025

Uh oh!

devin-ai-integration bot commented Nov 13, 2025

Uh oh!

theoephraim commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

penalosa commented Jan 27, 2026

Uh oh!

theoephraim commented Feb 12, 2026

Uh oh!

petebacondarwin commented Feb 19, 2026

Uh oh!

github-actions bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

workers-devprod commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

dario-piotrowicz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

devin-ai-integration bot commented Oct 7, 2025 •

edited by petebacondarwin

Loading

changeset-bot bot commented Oct 7, 2025 •

edited

Loading

pkg-pr-new bot commented Oct 7, 2025 •

edited

Loading

theoephraim commented Dec 2, 2025 •

edited

Loading

github-actions bot commented Mar 12, 2026 •

edited

Loading

workers-devprod commented Mar 13, 2026 •

edited

Loading