[waleedlatif1]

Summary

Follow-ups to #9632 (Trigger.dev env sync from the app's Secrets Manager secret), from a final review of the release branch.

• Keep secret text out of the error. A malformed env-vars secret failed with the JSON parser's message, which quotes the text around the fault (part of a value), and the Trigger.dev deploy prints that error to a public CI log. The error now names only the failure.
• Refuse a malformed sync-target list. TRIGGER_ENV_SYNC_TARGETS was split on commas with no validation, so Staging or a typo silently kept the environment on the old path. parseTriggerEnvSyncTargets (next to APP_ENV_SECRET_IDS) accepts only the exact comma list the deploy workflows' credential checks match, and refuses a padded, empty, or unknown entry (checked by own key, so constructor cannot pass); the deploy exits on it (syncEnvVars swallows throws) and logs which path it took. resolveTriggerEnvFromAppSecret uses the same own-key lookup.
• Accurate docs. The sync TSDoc now says the CLI applies variables when it uploads the version (before promotion) and that the sync only adds or updates; fetchRuntimeSecrets retries every failed request (not only transient ones); the worker-marker comments point at TRIGGER_CONSTANT_VARS; FUNCTION_EXECUTION_ENV notes it applies only outside the sync list.

Type of Change

• Bug fix

Testing

• packages/runtime-secrets: keeps the secret text out of a malformed-JSON error (red on the old code: the message contained the value); parseTriggerEnvSyncTargets reads the exact list, treats an unset gate as none, and refuses padded, empty, and unknown entries (red with trimming restored, or with in instead of an own-key check). 13/13.
• type-check for packages/runtime-secrets and apps/sim; lint and type-check (pre-push hooks); remaining audits in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 4, 2026 10:52am UTC

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues remain.

Summary

The PR keeps secret text out of JSON errors and rejects malformed TRIGGER_ENV_SYNC_TARGETS lists.

• Trigger.dev deploys reject invalid sync targets before choosing a secret.
• Malformed secret errors no longer include snippets of secret text.
• Sync and worker notes explain when settings apply and where the worker marker comes from.

_{Reviews (2) · Last reviewed commit: "fix(trigger): accept only the exact sync..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}