Skip to main content

v2.88.1

Binaries and the merged-pull-request list are on the GitHub releases page.

Each reference gets the value of the environment it names​

A deploy can read the same key from more than one environment. The turso starter's web Worker does this. Its secretEnv reads both wiring documents that the cloudflare-d1 roots publish:

secretEnv:
  WIRING_CLOUDFLARE_D1_STAGE: "secret://turso-starter/turso-starter/stage/WIRING_CLOUDFLARE_D1"
  WIRING_CLOUDFLARE_D1_PROD: "secret://turso-starter/turso-starter/prod/WIRING_CLOUDFLARE_D1"

Since Orunbase began accepting a resolve that spans several environments (SE5-multi), its answer has carried the values in two shapes:

  • secretsByEnv, grouped by environment;
  • a flat secrets map keyed by key name only. This map holds a key once, with the value from the last environment group.

orun read only the flat map. Every reference to WIRING_CLOUDFLARE_D1 therefore got the same document, and it came from the other environment: the job's own environment is the first group of its resolve, because its profile bindings sort first. A real deploy showed it:

web.stage.verify-deploy   Uploaded d1-todos-web-stage   env.DB (prod-d1-todos-prod)
web.prod.verify-deploy    Uploaded d1-todos-web-prod    env.DB (stg-d1-todos-stage)

From this release each reference is looked up in secretsByEnv under its own environment. A key that is missing there counts as missing. orun never takes it from another environment or from the flat map, so a best-effort reference is skipped, not filled with another environment's value. Environment slugs match without regard to case, as Orunbase matches them.

An Orunbase without secretsByEnv still answers single-environment jobs from the flat map. A job that asks such a backend for one key in several environments now fails before its first step and names the key and the environments. Before, it would have run with one environment's value under both names.

What to do​

  • Move the orun pin in a product's CI (.github/workflows/ci.yml, version:) to v2.88.1 or later. Lanes that pin an earlier version keep the old behaviour.
  • Redeploy every environment of a product whose deploy jobs read one key from several environments (wiring documents such as WIRING_CLOUDFLARE_D1 or WIRING_CLOUDFLARE_KV). Workers deployed by an earlier orun are still bound to the other environment's resources until they are deployed again.