fix(trigger): accept only the exact sync-target list the deploy workflows match

The workflows grant the secret-read credentials by matching TRIGGER_ENV_SYNC_TARGETS as an exact
comma list, so a trimmed parser could accept a padded entry the credential step skipped and fail
inside the sync instead. The parser now refuses a padded, empty, or unknown entry with a message
naming the expected format.

Author: waleedlatif1

apps/sim/trigger.config.ts

@@ -78,8 +78,8 @@ function getFunctionExecutionEnvVars() {
 const syncLogger = createLogger('TriggerEnvSync')
 
 /**
- * The environments `TRIGGER_ENV_SYNC_TARGETS` lists. Exits on a name with no mapped secret:
- * `syncEnvVars` swallows a thrown error, and a typo must not silently keep the old path.
+ * The environments `TRIGGER_ENV_SYNC_TARGETS` lists. Exits on a list the deploy workflows would
+ * not match: `syncEnvVars` swallows a thrown error, and a typo must not silently keep the old path.
  */
 function syncTargets(): Set<string> {
   try {

packages/runtime-secrets/src/trigger-env.test.ts

@@ -2,23 +2,29 @@ import { describe, expect, it } from 'vitest'
 import { parseTriggerEnvSyncTargets } from './trigger-env'
 
 describe('parseTriggerEnvSyncTargets', () => {
-  it('reads a comma list with stray whitespace and empty entries', () => {
-    expect([...parseTriggerEnvSyncTargets(' preview, staging ,,prod ')].sort()).toEqual([
+  it('reads an exact comma list', () => {
+    expect([...parseTriggerEnvSyncTargets('preview,staging,prod')].sort()).toEqual([
       'preview',
       'prod',
       'staging',
     ])
   })
 
-  it('treats an unset or blank gate as no targets', () => {
+  it('treats an unset or empty gate as no targets', () => {
     expect(parseTriggerEnvSyncTargets(undefined).size).toBe(0)
-    expect(parseTriggerEnvSyncTargets('  ').size).toBe(0)
+    expect(parseTriggerEnvSyncTargets('').size).toBe(0)
   })
 
-  it.each(['Staging', 'production', 'constructor', 'toString'])(
-    'refuses %s, which no app env-vars secret is mapped to',
-    (target) => {
-      expect(() => parseTriggerEnvSyncTargets(`preview,${target}`)).toThrow(target)
-    }
-  )
+  it.each([
+    'preview, staging',
+    'preview,,staging',
+    'preview,',
+    ' ',
+    'preview,Staging',
+    'preview,production',
+    'constructor',
+    'preview,toString',
+  ])('refuses %j, which the deploy workflows would not grant credentials for', (value) => {
+    expect(() => parseTriggerEnvSyncTargets(value)).toThrow(/TRIGGER_ENV_SYNC_TARGETS/)
+  })
 })

packages/runtime-secrets/src/trigger-env.ts

@@ -75,19 +75,19 @@ export function diffTriggerEnv(vars: TriggerEnvVar[], current: Record<string, st
 }
 
 /**
- * Parses the `TRIGGER_ENV_SYNC_TARGETS` repository variable: a comma list of Trigger.dev
- * environment slugs. Refuses any slug without a mapped secret rather than ignoring it, so a typo
- * fails the deploy instead of silently keeping the environment on its old configuration.
+ * Parses the `TRIGGER_ENV_SYNC_TARGETS` repository variable: an exact comma list of Trigger.dev
+ * environment slugs, such as `preview,staging,prod`. The deploy workflows decide whether to grant
+ * the secret-read credentials by matching that same exact list, so an entry they would not match
+ * (padded, empty, or a slug with no mapped secret) fails the deploy here rather than syncing
+ * without credentials or silently keeping the environment on its old configuration.
  */
 export function parseTriggerEnvSyncTargets(value: string | undefined): Set<string> {
-  const targets = (value ?? '')
-    .split(',')
-    .map((target) => target.trim())
-    .filter(Boolean)
-  const unknown = targets.filter((target) => !Object.hasOwn(APP_ENV_SECRET_IDS, target))
-  if (unknown.length > 0) {
+  if (!value) return new Set()
+  const targets = value.split(',')
+  const invalid = targets.filter((target) => !Object.hasOwn(APP_ENV_SECRET_IDS, target))
+  if (invalid.length > 0) {
     throw new Error(
-      `TRIGGER_ENV_SYNC_TARGETS names environments with no app env-vars secret: ${unknown.join(', ')}`
+      `TRIGGER_ENV_SYNC_TARGETS must be a comma list of ${Object.keys(APP_ENV_SECRET_IDS).join(', ')} with no spaces; refused: ${invalid.map((target) => JSON.stringify(target)).join(', ')}`
     )
   }
   return new Set(targets)