@jondotsoy/envs 0.1.3 → 0.1.4

package/README.md

@@ -33,6 +33,26 @@ Run the commands inside the repo or any of its worktrees. Inside a worktree, `.e
 
 Worktrees are identified by their branch name (or their folder name if they are in detached HEAD). The main repo uses its branch name, for example `main`.
 
+### Output
+
+`envs pull` prints one green line with the pulled branches and the number of variables:
+
+```
+↓ pulling main, feature/biz - 3 variables
+```
+
+`envs push` prints one yellow line for each variable whose value changes, listing the branches where it changed. Variables that already have the same value are not shown:
+
+```
+↻ LOG_LEVEL=info → main, feature/biz
+```
+
+Colors are disabled when the [`NO_COLOR`](https://no-color.org) environment variable is set to a non-empty value:
+
+```sh
+NO_COLOR=1 envs push
+```
+
 ### `envs lint`
 
 It never prints values, only the variable and its location (`envs.DB_PASSWORD.main`).

package/SECURITY.md

@@ -44,3 +44,13 @@ Additionally:
 - `envs init` creates `.envs/.gitignore` with `*`, so the `.envs/` folder is not committed to git. Do not remove that file.
 - `envs push` writes the values to the `.env` files of each worktree. Make sure `.env` is in your project's `.gitignore`.
 - Do not share `values.yml` or paste it in issues or logs.
+
+## Console output
+
+`envs push` prints one line for each variable whose value changes, in the form `↻ NAME=VALUE → branch, ...`, and `envs pull` prints `↓ pulling branch, ... - N variables`. To keep secrets out of the terminal and CI logs:
+
+- The value is replaced by `********` when the variable name contains a sensitive word: `SECRET`, `PASSWORD`, `PASSWD`, `PWD`, `TOKEN`, `KEY` (including `API_KEY` and `PRIVATE_KEY`), `CREDENTIAL`, `AUTH`, `SALT` or `SIGNING`. The match is case-insensitive and applies to whole `_`-separated words, so `KEY_FOO` and `AWS_BUCKET_SECRET` are masked but `MONKEY` is not.
+- Masking is based on the name only. A secret stored in a variable with an innocuous name (for example `DATABASE_URL` with a password inside) is printed as is.
+- `envs pull` never prints values, only branch names and the number of variables.
+- `envs lint` messages never include the matched value.
+- Set `NO_COLOR` to a non-empty value to print the output without colors.

package/envs.js

@@ -229,6 +229,12 @@ Commands:
   edit    Pull, open .envs/values.yml in VS Code (code -w), then push
   help    Show this help message
 `;
+var colorsDisabled = () => Boolean(process.env.NO_COLOR);
+var MASK = "********";
+var isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key);
+var paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`;
+var green = (text) => paint(32, text);
+var yellow = (text) => paint(33, text);
 var defaultContext = () => ({
   cwd: process.cwd(),
   log: (message) => console.log(message),
@@ -348,6 +354,7 @@ async function push(ctx) {
   if (!read)
     return 1;
   const { values } = read;
+  const changes = new Map;
   for (const { name, path } of await listWorktrees(ctx.cwd)) {
     const entries = {};
     for (const [key, value] of Object.entries(values.defaults ?? {})) {
@@ -361,8 +368,18 @@ async function push(ctx) {
       continue;
     const dotenv = Bun.file(join(path, ".env"));
     const current = await dotenv.exists() ? await dotenv.text() : "";
+    const existing = parseDotenv(current);
+    for (const [key, value] of Object.entries(entries)) {
+      if (existing[key] === value)
+        continue;
+      const shown = isMaskedKey(key) ? MASK : formatDotenvValue(value);
+      const line = `${key}=${shown}`;
+      changes.set(line, [...changes.get(line) ?? [], name]);
+    }
     await Bun.write(dotenv, updateDotenv(current, entries));
-    ctx.log(`Pushed ${name}`);
+  }
+  for (const [line, names] of changes) {
+    ctx.log(yellow(`\u21BB ${line} \u2192 ${names.join(", ")}`));
   }
   return 0;
 }
@@ -373,11 +390,16 @@ async function pull(ctx) {
   const { path: valuesPath, values } = read;
   const envs = values.envs ??= {};
   const defaults = values.defaults ?? {};
+  const pulledNames = [];
+  const pulledKeys = new Set;
   for (const { name, path } of await listWorktrees(ctx.cwd)) {
     const dotenv = Bun.file(join(path, ".env"));
     if (!await dotenv.exists())
       continue;
     const parsed = parseDotenv(await dotenv.text());
+    pulledNames.push(name);
+    for (const key of Object.keys(parsed))
+      pulledKeys.add(key);
     for (const [key, byWorktree] of Object.entries(envs)) {
       if (!(key in parsed))
         delete byWorktree[name];
@@ -392,13 +414,15 @@ async function pull(ctx) {
         (envs[key] ??= {})[name] = parsedValue;
       }
     }
-    ctx.log(`Pulled ${name}`);
   }
   for (const [key, byWorktree] of Object.entries(envs)) {
     if (Object.keys(byWorktree).length === 0)
       delete envs[key];
   }
   await Bun.write(valuesPath, Bun.YAML.stringify(values, null, 2));
+  if (pulledNames.length > 0) {
+    ctx.log(green(`\u2193 pulling ${pulledNames.join(", ")} - ${pulledKeys.size} variables`));
+  }
   return 0;
 }
 async function isIgnored(dir, file) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jondotsoy/envs",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "license": "MIT",
   "author": {
     "name": "Jonathan Delgado",