fix(trigger): sync worker configuration from Secrets Manager at deploy

[BillLeoutsakosvl346]

Summary

Trigger workers now run more application code directly, but the existing deployment hook only copied a small subset of the deployer's environment. Extend syncEnvVars to fetch the mapped combined AWS Secrets Manager object at deployment time and synchronize only approved platform configuration. Keep customer credentials in the application database.

The deployment-only module reuses the shared capability/OAuth/LLM registries, records consumer and secret classification for additional worker settings, validates source and effective configuration, and preserves Trigger-owned database, Redis, PII and telemetry settings. Missing optional values preserve existing Trigger values and produce names-only notices; no automatic deletion or continuous rotation propagation is included. The adapter sanitizes failures and exits with code 1 because Trigger 4.5.12 swallows ordinary callback exceptions.

Type of Change

• Bug fix
• Documentation
• Breaking change: deployments fail closed until the separate orchestration work supplies the required configuration/access.

Deployment prerequisites

Keep this draft until configuration ownership and deployment wiring are reviewed. This PR deliberately leaves CI orchestration, IAM and live environment changes to the separate investigation.

• Supply SIM_TRIGGER_ENV_SYNC_PROJECT_REF and SIM_TRIGGER_ENV_SYNC_REGION in each deployment entrypoint, using existing Trigger authentication and the AWS default credential chain.
• Approve a names-only source/target inventory, supported capability baseline and ownership exceptions for each target. Database URLs and SIM_DB_ROLE remain Trigger-owned; no pool behavior changes.
• Grant the deployment identity GetSecretValue on the exact environment secret ARN, plus kms:Decrypt only when its customer-managed key requires it. Workers need no Secrets Manager grant.
• Target mapping: preview/dev-sim → /dev/sim/env-vars; branchless staging → /staging/sim/env-vars; branchless prod → /production/sim/env-vars. Staging/prod project references and deploy entrypoints still need live verification.
• Do not skip synchronization or tolerate a nonzero deploy exit. Roll out preview/dev-sim, then staging, then production.

Environment import and code promotion are not atomic. Running/checkpointed jobs and cached clients may retain old configuration; omission and code rollback do not restore previous values. Removed/renamed variables require explicit owner-reviewed retirement, including preview inheritance and existing secret classification.

Testing

Completed before the request to stop further testing:

• 135 tests passed across the new colocated suite and existing capability, environment, runtime-marker, Redis and deployment-script suites. The new file covers the six planned behavior groups, including the actual pinned Trigger extension's fatal-exit boundary.
• App type-check and app lint passed.
• API-validation check and all 46 repository audits passed.
• Ran the normal root bun run test once. It stopped on two unrelated packages/sim-cli/src/update/check.process.test.ts assertions: local Node 22.23.1 emits an experimental EnvHttpProxyAgent warning where the tests expect empty stderr. Turbo cancelled remaining suites; the full suite is not green. CI uses Node 24. Runtime-secrets tests passed before cancellation.

The disposable non-production smoke test is deferred at the requester's direction. No live secret synchronization, production-secret retrieval, deployment, IAM change, or external configuration update was performed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Focused tests added/updated and passing
• Full CI passing
• Disposable non-production smoke test and configuration-owner approval before rollout
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 9, 2026 11:22pm UTC