Conversation
Adds variables list, set, remove and import over the endpoints ADR 062 shipped. Values are prompted for or piped, never passed as a flag.
Keep the owner flag out of server resolution, honour --dry-run in set, accept an empty value, cap names at 255, parse __proto__ safely, and document the commands.
Prettier stripped a list continuation indent. Every variables command now prints the server it resolved, so the target is never silent.
Matches the CRUD verb set in the CLI design doc and ADR 064, and the delete verb gh and wrangler both use.
Dry-run emits an ok plan like reset and apply, delete takes the same force-or-confirm gate as reset, and the owner moves into the table header the way schemas list carries its objectType.
A stored value is chosen by anyone holding variable.write, so printing it raw let a newline break the table and an escape byte drive the terminal. Adds variables get, which the API already exposed.
parseEnvFile builds its map from entries rather than assigning into one, which also removes the null-prototype workaround. Drops two non-null assertions and an unused import.
Inlining the prompt dropped its nullish guard, so submitting nothing would have stored the literal "undefined". Adds the missing tests for get.
A run with --environment and --secret was told to retry without either, which would write a non-secret at project scope. Dimensions now follow the is_/count naming and are documented with a conformance test.
…tsa-51ce4e Adapts the variables commands to #1210: registers them in the explicit command table, declares --force per command, drops groupOrder so they sort with the resource commands, and prints the project header only on a TTY.
Adds an EnvironmentCommand base: --environment (alias --env) or --project-level, prompting a person and refusing a non-interactive run that names neither. Drops variables import for now.
Values were always sent as strings, so a whole-field reference resolved to "5" instead of 5. --type is refused with --secret, and an integer too large to store exactly is refused rather than rounded.
Vercel uses --type for secret versus config, which reads the opposite way.
Dry runs answer with dry_run: true instead of claiming a deletion. The API coverage guard now counts the variables commands' calls, and the name-length test once again exercises the cap.
list and get share the house table, --plain and pipe rules; the four commands share one connect step and carry examples.
…resources It only picked a server from zitadel.json environments.<name>.server, which nothing writes, and its enum matched none of the platform's environments.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
🦋 Changeset detectedLatest commit: 7a258e3 The changes in this PR will be included in the next version bump. This PR includes changesets to release 20 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The agent contract is inaccurate, command-level regression coverage is missing, and the PR title conflicts with repository classification rules.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (3)
What changed in this PR
Aligns --environment with platform environments by removing its obsolete server-selection meaning.
Changes:
- Removes the flag from
plan,apply, and resource commands. - Simplifies server resolution to ignore per-environment config blocks.
- Updates tests, CLI documentation, and release notes.
| File | Description |
|---|---|
.changeset/drop-dead-environment-flag.md |
Documents the breaking CLI change. |
apps/cli/README.md |
Updates generated command help. |
apps/cli/SKILLS.md |
Describes the revised environment contract. |
apps/cli/src/commands/apply.ts |
Removes the environment flag. |
apps/cli/src/commands/plan.ts |
Removes the environment flag. |
apps/cli/src/commands/resources.ts |
Removes environment flags from generated commands. |
apps/cli/src/lib/environment.ts |
Deletes the obsolete closed enum. |
apps/cli/src/lib/oclif/base.ts |
Stops forwarding an environment to server resolution. |
apps/cli/src/lib/oclif/crud/fields.ts |
Allows environment-named body fields. |
apps/cli/src/lib/oclif/crud/types.ts |
Generalizes flag documentation. |
apps/cli/src/lib/oclif/environment-command.ts |
Passes owner flags through normally. |
apps/cli/src/lib/server.ts |
Removes per-environment server resolution. |
apps/cli/tests/unit/lib/environment.test.ts |
Removes obsolete enum tests. |
apps/cli/tests/unit/lib/server.test.ts |
Verifies environment blocks are ignored. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…nment Also stop SKILLS.md implying apply changes what environments run.
mridang
changed the title
vitorbari
self-requested a review
September 22, 2026 08:01
…nvironment-flag # Conflicts: # apps/cli/src/lib/environment.ts # apps/cli/src/lib/oclif/environment-command.ts # apps/cli/tests/unit/lib/environment.test.ts
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--environmentmeant two unrelated things in the CLI. Onvariables(#1259) it names a real environment on the platform, checked by the server. Onplan,applyand every resource command it was a leftover from the first CLI prototype (#14), where development, preview and production were separate Zitadel servers: a closeddevelopment | preview | productionenum whose only effect was to read a server URL fromzitadel.jsonenvironments.<name>.server. Nothing has written that key since the CLI rewrite (#158), and the enum matches none of the platform's environments (dev,staging,prod, any DNS label), soapply -e prodwas rejected andapply -e productionwas accepted while doing nothing. A user who learned-e prodonvariableswould reasonably expectapply -e prodto targetprod.This follows #1259 (now merged) and leaves its
EnvironmentCommandas the only definition of the flag.environmentSchemais deleted, along with everyoptions:that used it.config-envserver tier is gone:readEnvServer, theenvironmentinput toresolveServer, and the"development"default inBaseCommand.toMeta.--server,ZITADEL_API_BASE, the top-levelserverinzitadel.json,localand the default are unchanged.planandapplyno longer take--environment. What they sync (schemas, flow definitions, branding, IdPs) is project-scoped and none of those endpoints takes an environment; the server has no deployments endpoints yet, so there is no environment for the flag to name. Giving them a server-checked-ewould suggestapply -e prodtargetsprodwhen it does no such thing.deploy(ADR 035) is where a real environment target arrives.--environment. Their endpoints are project-scoped, and the flag never reached the API.environmentis also dropped from the crud builder's reserved flag names, since no generated command owns it now.-eto these commands now fails with oclif'sNonexistent flagerror.EnvironmentCommandno longer withholds the flag from server resolution; with theconfig-envtier gone there is nothing for it to redirect.Validation
corepack pnpm exec vitest runinapps/cli: 130 files, 1431 tests passing.plan.test.ts,apply.test.tsandresources.test.tspin that-e/--environmentis refused, andresources.test.tsalso asserts that no generated resource command declares anenvironmentflag or an-eshort flag.tests/unit/lib/server.test.tsdrops theconfig-envcases and asserts that anenvironments.<name>.serverblock is ignored;tests/unit/lib/environment.test.tsdrops the enum cases.corepack pnpm exec oxlint .: 0 errors (28 pre-existing warnings, none in touched files).corepack pnpm exec tsc -p tsconfig.app.json --noEmit: no errors in touched files; the remaining errors are pre-existing inlocal-server/env-vars.tsandorca/patchers.prettier --checkon touched files: the only reports are pre-existing lines inresources.ts,base.tsandcrud/fields.tsthat this change does not touch.apps/cli/README.mdentries forplan,applyand the 35 resource commands updated fromCOLUMNS=80 node bin/run.js <cmd> --help, and each checked to match it exactly.grants createandgrants listwere already out of date on the base branch (they predate feat(api): accept user and team locators on grants #1192's locators), so only their-elines changed. The pinned help intests/unit/commands/help.test.tsdid not shift.go buildunder devbox, sqlite,--migrate, a project fromPOST /projects), withzitadel.jsonholdingserver: http://localhost:8080andenvironments.production.serverpointing at a closed port:apply -e prod,apply --environment productionandusers list -e productionfail withNonexistent flag, exit 3.plan --jsonandapply --jsonsucceed againsthttp://localhost:8080, so the stale per-environment block is ignored.environments listshowsdev,prod,staging;variables set GREETING -e prodthenvariables get GREETING -e prodround-trips;variables list -e nopereturnsenvironment not found;variables listwith no owner is refused, naming the three environments.Release notes / changeset
.changeset/drop-dead-environment-flag.md.@zitadel/climinor, marked Breaking: a flag is removed from shipped commands.Notes
apps/cli/SKILLS.mdnow says thatplan,applyand the resource commands take no--environmentand do not select an environment, thatvariablesis the only command group that addresses one, and that putting config onto an environment isdeploy's job.fixbecause a CLI user could hit the broken behaviour:apply -e productionwas accepted and did nothing (CONTRIBUTING.md title ladder).Context: ADR 035, ADR 062, #1259.