- Public client env:
NEXT_PUBLIC_*only, validated incommon/src/env-schema.ts(used via@codebuff/common/env). - Server secrets: validated in
packages/internal/src/env-schema.ts(used via@codebuff/internal/env). - Runtime/OS env: pass typed snapshots instead of reading
process.envthroughout the codebase.
- Base contracts:
common/src/types/contracts/env.ts(BaseEnv,BaseCiEnv,ClientEnv,CiEnv) - Helpers:
common/src/env-process.ts,common/src/env-ci.ts - Test helpers:
common/src/testing-env-process.ts,common/src/testing-env-ci.ts - CLI:
cli/src/utils/env.ts(getCliEnv) - CLI test helpers:
cli/src/testing/env.ts(createTestCliEnv) - SDK:
sdk/src/env.ts(getSdkEnv) - SDK test helpers:
sdk/src/testing/env.ts(createTestSdkEnv)
Bun loads (highest precedence last):
.env.local(Infisical-synced secrets, gitignored).env.development.local(worktree overrides like ports, gitignored)
Release scripts read CODEBUFF_GITHUB_TOKEN.