Add guarded build-time secret probe for Webflow Cloud E2E tests#8
Open
fbaralle wants to merge 1 commit into
Open
Add guarded build-time secret probe for Webflow Cloud E2E tests#8fbaralle wants to merge 1 commit into
fbaralle wants to merge 1 commit into
Conversation
Webflow Cloud's end-to-end tests verify that build-time secret values are redacted from build logs. That requires the app to print the secret during the build so there is something to redact. This adds a build-time probe (scripts/e2e-buildtime-secret-probe.mjs) that prints E2E_TEST_SECRET behind a stable marker during the production build, invoked from next.config.ts so it runs under `opennextjs-cloudflare build`. It is a no-op unless E2E_TEST_SECRET is set, so normal builds and `next dev` are unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a guarded build-time probe so Webflow Cloud's end-to-end tests can verify that build-time secret values are redacted from build logs.
The E2E test sets a secret environment variable
E2E_TEST_SECRETand checks that its value never appears in the build logs. For that check to be meaningful, the app has to actually print the secret during the build — a plainnext buildprints nothing, so there would be nothing to redact.Changes
scripts/e2e-buildtime-secret-probe.mjs— printsE2E_TEST_SECRETbehind a stable marker ([webflow-cloud-e2e] build-time secret probe), one line at a time. No-op unlessE2E_TEST_SECRETis set.package.json— adds thee2e:buildtime-secret-probescript.next.config.ts— during the production build (PHASE_PRODUCTION_BUILD, whichopennextjs-cloudflare buildruns), invokes the probe so its output flows through the build log pipeline. Guarded onE2E_TEST_SECRET, sonext devand normal builds are unaffected.User impact
None for normal users. The hook only runs during a production build and only when
E2E_TEST_SECRETis present, which only the E2E sets. When it does run, the printed value is redacted before build logs are exposed — that redaction is exactly what the E2E verifies.🤖 Generated with Claude Code