refactor(secrets): state the .env layering once, and let callers read it - #5567
Open
aodhanroche wants to merge 1 commit into
Open
aodhanroche wants to merge 1 commit into
aodhanroche wants to merge 1 commit into
Conversation
`get_secret` documents that a workspace `.env` beats the global one, but the merge expressing that lived inside `_read_merged_env_files` as a private detail. The diagnostics report added later in this stack reads the same two files itself, so that it can say which file each key came from -- and a second hand-written copy of the merge means a later change to the layering could be applied to secret resolution and not to the report of it, leaving the report quietly wrong about which file a support engineer should be looking at. Extracts the merge into a module-level `merge_env_file_values`, splits the per-file read into `_read_env_file`, and renames `_read_merged_env_files` to `read_merged_env_files` so the report can resolve the same values this manager resolves from -- which is what lets it scrub them out of log text rather than guess at them. No behaviour change: workspace still wins, empty values are still kept as empty strings, missing files are still skipped, and `None` from `dotenv_values` is still filtered so callers keep a `dict[str, str]`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Sep 16, 2026
aodhanroche
added this pull request to stack #5574
September 16, 2026 17:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
The
.envlayering (workspace beats global) was buried in a private method. The diagnostics report later in this stack reads the same two files to say which file each key came from — a second copy of that merge means the report could go quietly wrong about which file to look at.Fix
Pull the merge into a module-level
merge_env_file_values, split the per-file read into_read_env_file, and makeread_merged_env_filespublic so the report can resolve the same values.No behaviour change. Gets its first caller in #5571.
🤖 Generated with Claude Code