[tyffical]

Motivation

• The Node backend runtime doesn't pass the developer's environment variables or Custom Credentials to backend functions, so process.env.X finds nothing in production, and nothing flags the gap before upload. (APPS-2945, design)
• Warn, don't block: the code is valid, and the Secret Store integration will supply these values; it's a static check, not the runtime Proxy that [APPS-2792 Clean up: revert process.env scoping and the Custom Credentials local-file mechanism]([APPS-2792] Clean up: revert process.env scoping and the Custom Credentials local-file mechanism #523) removed.
• Stacked on [APPS-2945 Update: switch the apps plugin's static checks to the Node backend runtime]([APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557).

Architecture

flowchart TD
    T[".backend.* transform"] --> R["runBackendStaticChecks (app-local modules only)"]
    L["local run (module-graph walk)"] --> R
    V["vite build (nested backend build)"] --> R
    R --> M["rejectGlobalsMissingFromNode"]
    R --> W["warnAboutEnvReads"]
    W -->|"process.env.X, a destructure, an env import, a const alias"| K["warn: process.env.X"]
    W -->|"process.env[key], a rest destructure"| A["warn: process.env"]
    W -->|"writes, deletes, indirect forms"| N["no warning"]

Loading

• The check warns once per file and use, and never fails a build.

Changes

5 changes across warn-env-reads.ts, ambient-global-access.ts, run-backend-static-checks.ts, README.md and tests

What changed	File
Add warnAboutEnvReads, which warns on direct process.env reads, naming static keys.	warn-env-reads.ts
Export the static-name helpers it reuses.	ambient-global-access.ts
Run the warning after the missing-global check.	run-backend-static-checks.ts
Document the forms it catches and the modules it skips.	README.md
Test must-warn and must-not-warn forms, dedup and module skips.	warn-env-reads.test.ts, dev-server-module-graph.test.ts

QA Instructions

• Test URL: CI run for 9e703c8a https://github.com/DataDog/build-plugins/actions/runs/40027770084

yarn typecheck:all && yarn lint && yarn cli integrity
# Expected: all exit 0, integrity leaves no file changes ✅ VERIFIED
yarn build:all && yarn test:unit packages/plugins/apps
# Expected: Test Suites: 42 total; Tests: 1071 total, all passed except 15 manifest-tags and parameters tests, which fail on macOS's /var TMPDIR ✅ VERIFIED

• Manual QA uses the helper scripts in [APPS-2945 Update: switch the apps plugin's static checks to the Node backend runtime]([APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557 QA section, with a Vite 8 scaffold and the Vite 5 app from [APPS-2945 Update: drop the in-process local execution guard in favor of Node's permission model]([APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model #563 QA.

Fixtures and staging runs

• src/useEnv.backend.ts:

export async function readStripeKey() { return process.env.STRIPE_KEY ?? null; }

• src/useRestEnv.backend.ts:

export async function readRest() {
    const { env, ...rest } = process;
    return { region: env.REGION ?? null, restKey: rest.env?.STRIPE_KEY ?? null };
}

cd "$QA_DIR" && QA_APP=<vite 8 scaffold> ./install-plugin.sh 565 <build-plugins checkout of this branch>
QA_APP=<vite 8 scaffold> ./qa-run.sh development useEnv useRestEnv useFetch
# Output: one warning each, "useEnv.backend.ts uses process.env.STRIPE_KEY" and "useRestEnv.backend.ts uses process.env.REGION"; none for useFetch ✅ VERIFIED
# Expected with DD_API_KEY and DD_APP_KEY set: 3 "in a child process" lines; readStripeKey null, readRest {"region":null,"restKey":null}
for app in <vite 8 scaffold> <vite 5 app>; do for m in development dev-verify; do
  QA_APP=$app env STRIPE_KEY=qa-local-value ./qa-run.sh $m useEnv | grep -E "readStripeKey|uses process.env"
done; done
# Expected: Vite 5 development returns "qa-local-value"; Vite 8 development and both dev-verify runs return null; all four warn

Blast Radius

• Apps whose backend modules read process.env directly (NODE_ENV included) get new warn-level log lines in builds and the dev server.
• Warning only: builds never fail.
• No feature flag.
• Low risk.

Out of Scope / Follow-ups

1 item deferred

Item	Status	Next step
Indirect forms don't warn: parameters and defaults, let/var or second-level aliases, nested env destructures, namespace, default as and dynamic imports, re-exports, literal wrappers, .then callbacks, Object.assign/Reflect, globalThis.process, for-of bindings, spreads, Object.keys, in. NODE_ENV and keys the file assigns itself still warn; warnings show once per file per dev-server process	Accepted	None; exempt NODE_ENV if the runtime sets it

Documentation

• Design page: Milestone 1, "Warn on env reads"
• RFC: Secret Store for Backend Functions
• Jira: APPS-2945

🤖 Generated with Claude Code

[datadog-prod-us1-6]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 9e703c8 | Docs | View more details | Give us feedback!}

[tyffical]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T16:49:04.250227Z	a779bfd	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

Optional-chain deletes incorrectly emit environment-read warnings instead of being excluded like plain deletes.

1 open issue

• Skip environment-read warnings for optional-chain deletes · New

What changed in this PR

Adds warning-only checks for backend process.env reads, extending the apps plugin’s Node runtime checks to flag values unavailable in production.

Changes:

• Detects direct reads, destructuring, supported imports, and first-level const aliases, with per-file warning deduplication.
• Integrates warnings into shared backend static checks.
• Documents supported forms and adds unit and module-graph coverage.

File	Description
packages/​plugins/​apps/​src/​vite/​dev-server-module-graph.test.ts	Tests local-run warnings, deduplication, and dependency skips.
packages/​plugins/​apps/​src/​backend/​ast-parsing/​warn-env-reads.ts	Implements environment-read detection and warning reporting.
packages/​plugins/​apps/​src/​backend/​ast-parsing/​warn-env-reads.test.ts	Tests detection, exclusions, deduplication, and failure handling.
packages/​plugins/​apps/​src/​backend/​ast-parsing/​run-backend-static-checks.ts	Invokes the new warning check.
packages/​plugins/​apps/​src/​backend/​ast-parsing/​run-backend-static-checks.test.ts	Tests shared-check warning integration.
packages/​plugins/​apps/​src/​backend/​ast-parsing/​ambient-global-access.ts	Exports helpers reused by the detector.
packages/​plugins/​apps/​README.md	Documents warnings, supported forms, and module exclusions.

_{Review effort: Balanced}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: a779bfd271

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".