Repository navigation
Accept VARLOCK_* aliases for _VARLOCK_* config vars (AWS Lambda) - #1295
Merged
Merged
Conversation
AWS Lambda rejects env var names starting with an underscore, so _VARLOCK_ENV_KEY (needed at runtime for an encrypted frozen env) cannot be set there. Each _VARLOCK_* config var can now also be set without the leading underscore; the underscore form wins when both are set.
github-actions
Bot
added
maintainer
core:website
core:varlock
integration:nextjs
labels
Contributor
|
The changes in this PR will be included in the next version bump.
|
Contributor
📦 Bundle size
dist/ only; native binaries are versioned separately and not counted here. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | 72ca471 | Commit Preview URL Branch Preview URL |
Nov 12 2026, 06:23 PM |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Important
The aliases need the same reserved-key protection as their canonical names, and encrypted runtime initialization still fails with alias-only keys on read-only environments.
Reviewed changes: Reviewed underscore-free configuration aliases across CLI startup, runtime initialization, auto-load, and frozen deployments.
- Alias normalization: Adds an explicit configuration-variable list and copies aliases before existing readers and environment snapshots run.
- Frozen deployment coverage: Adds helper, decryption, edge-bundle, and smoke tests, and switches the Next standalone scenario to
VARLOCK_ENV_KEY. - Registry and documentation: Registers the plaintext frozen-build opt-out and documents aliases and precedence in deployment and configuration references.
gpt-6.1-sol ｜ 𝕏
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the reserved-alias and read-only environment fixes since the prior review, plus the Lambda deployment clarification.
- Reserved configuration aliases across serialization, override provenance, and generated types while preserving computed builtins; added ambient-key regression coverage.
- Added read-time key fallback so encrypted runtime initialization accepts
VARLOCK_ENV_KEYon immutable environments; verified the frozen-environment edge regression. - Clarified deployment constraints and documented that alias names are reserved schema keys.
The build succeeded and all 264 runtime and reserved-key tests passed.
gpt-6.1-sol ｜ 𝕏
varlock
@varlock/astro-integration
@varlock/cloudflare-integration
@varlock/nextjs-integration
@varlock/nuxt-integration
@varlock/vite-integration
@varlock/native-helper-darwin
@varlock/native-helper-linux-arm64
@varlock/native-helper-linux-x64
@varlock/native-helper-win32-x64
@varlock/1password-plugin
@varlock/bitwarden-plugin
@varlock/keepass-plugin
@varlock/pass-plugin
@varlock/proton-pass-plugin
commit: |
theoephraim
added a commit
that referenced
this pull request
Nov 13, 2026
* Fix release PR smoke and framework test failures Keep the literal '_VARLOCK_ENV_KEY is not set' in the runtime missing-key error (changed in #1295), which framework tests assert on (and guard against with shouldNotContain). Skip the two run-output-drain smoke tests on Windows, where they have failed on every run since #1296. * Add empty bump file
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AWS Lambda rejects env var names that start with
_, so_VARLOCK_ENV_KEY(needed at runtime to decrypt an env frozen withfreezeIntoBundle) can't be set there. Reported on Discord; the workaround was copyingVARLOCK_ENV_KEYonto_VARLOCK_ENV_KEYat the top of the handler.Each user-settable
_VARLOCK_*config var can now also be set without the leading underscore (VARLOCK_ENV_KEY,VARLOCK_USE_FROZEN_ENV, ...). The underscore form wins when both are set.runtime/lib/config-env-aliases.tscopies aliases onto the_VARLOCK_*names when unset. Applied atvarlock/envmodule load (before the pre-injection snapshot),initVarlockRuntime,auto-load, and CLI startup, so existing readers are unchanged.reserved-vars.tsby a test), so builtins likeVARLOCK_ENVare never aliased. The alias names are reserved like_VARLOCK_*keys (isVarlockReservedKey), so a schema item namedVARLOCK_ENV_KEYis never serialized or typed.initVarlockRuntimereads the key with alias fallback directly, so decryption works whereprocess.envis read-only and the copy no-ops. Added the already-documented_VARLOCK_ALLOW_PLAINTEXT_FROZEN_ENVtoreserved-vars.ts.VARLOCK_ENV_KEY, edge-evaluable init-bundle case, smoke tests for frozen file /--out -payload boot with only underscore-free names. The Next standalonefreezeIntoBundleframework scenario now boots withVARLOCK_ENV_KEY.--out -env var payload does not fit Lambda (__VARLOCK_ENVname, 4 KB env limit).