Add Dotenv plugin

[krotovic]

Thanks for contributing the Netlify plugins directory!

Are you adding a plugin or updating one?

• Adding a plugin
• Updating a plugin

Plugin version diff

If updating a previously added package, create a diff at diff.intrinsic.com and provide a link to the diff here.
Example link: https://diff.intrinsic.com/@netlify/plugin-sitemap/0.3.3/0.3.4

Have you completed the following?

• Read and followed the plugin author guidelines.
• Included all required fields in your entry.
• Tested the plugin locally and on Netlify, using the plugin version stated in your entry.

Test plan
Please add a link to a successful public deploy log using the stated version of the plugin. Include any other context reviewers might need for testing.

https://app.netlify.com/sites/stoic-volhard-920e9f/deploys/5efda20f345129a8dd19089d

[netlify-bot]

Added Packages

• https://registry.npmjs.org/netlify-plugin-dotenv/-/netlify-plugin-dotenv-1.0.1.tgz

[erquhart]

Thanks for opening @krotovic! My immediate thought is that .env files shouldn't be committed to repositories, and so shouldn't be present during a deploy. Do you have a specific use case that we should be considering?

[ehmicky]

Note: two other users did ask for .env support (@moop-moop and @dimavolo) in netlify/build#1514

The issue describes a way this could be useful for them.

I am not sure whether this is @krotovic's intent but, technically, this plugin could work in CLI builds, where .env files do not have to be committed to git.

[krotovic]

Thanks for opening @krotovic! My immediate thought is that .env files shouldn't be committed to repositories, and so shouldn't be present during a deploy. Do you have a specific use case that we should be considering?

I understand that it's not recommended to commit env files into public repositories but I use private repos for commercial products where I think it's safe to have them committed in. This plugin would really help me as I always forget to update envs in dashboard when I change something in the code 😄 . I think that it might help anyone else.

However I have problem with testing it. I made simple NodeJS project to test this plugin but running it locally with netlify build will result in having process.env.TEST_ENV to return undefined. Does it require to have some specific version?
There is demo project https://github.com/krotovic/netlify-dotenv-demo

[krotovic]

I have tried to deploy it to Netlify instead of running it locally and it worked.

10:59:59 AM: Build ready to start
11:00:01 AM: build-image version: 9d79ad851d6eff3969322d6e5b1df3d597650c41
11:00:01 AM: build-image tag: v3.3.19
11:00:01 AM: buildbot version: 2cc7ea668a3e8f63326d15aab17e62cd1997fa2e
11:00:01 AM: Fetching cached dependencies
11:00:01 AM: Failed to fetch cache, continuing with build
11:00:01 AM: Starting to prepare the repo for build
11:00:02 AM: No cached dependencies found. Cloning fresh repo
11:00:02 AM: git clone https://github.com/krotovic/netlify-dotenv-demo
11:00:03 AM: Preparing Git Reference refs/heads/master
11:00:04 AM: Different build command detected, going to use the one specified in the Netlify configuration file: 'npm run build' versus 'node build.js' in the Netlify UI
11:00:04 AM: Starting build script
11:00:04 AM: Installing dependencies
11:00:04 AM: Python version set to 2.7
11:00:05 AM: v12.18.0 is already installed.
11:00:06 AM: Now using node v12.18.0 (npm v6.14.4)
11:00:06 AM: Started restoring cached build plugins
11:00:06 AM: Finished restoring cached build plugins
11:00:06 AM: Attempting ruby version 2.7.1, read from environment
11:00:07 AM: Using ruby version 2.7.1
11:00:08 AM: Using PHP version 5.6
11:00:08 AM: 5.2 is already installed.
11:00:08 AM: Using Swift version 5.2
11:00:08 AM: Started restoring cached node modules
11:00:08 AM: Finished restoring cached node modules
11:00:08 AM: Installing NPM modules using NPM version 6.14.4
11:00:09 AM: npm WARN netlify-demo@ No description
11:00:09 AM: npm WARN netlify-demo@ No repository field.
11:00:09 AM: npm WARN netlify-demo@ No license field.
11:00:09 AM: added 2 packages and audited 2 packages in 0.282s
11:00:09 AM: found 0 vulnerabilities
11:00:09 AM: NPM modules installed
11:00:09 AM: Started restoring cached go cache
11:00:09 AM: Finished restoring cached go cache
11:00:09 AM: go version go1.14.4 linux/amd64
11:00:09 AM: go version go1.14.4 linux/amd64
11:00:09 AM: Installing missing commands
11:00:09 AM: Verify run directory
11:00:10 AM: ​
11:00:10 AM: ┌─────────────────────────────┐
11:00:10 AM: │        Netlify Build        │
11:00:10 AM: └─────────────────────────────┘
11:00:10 AM: ​
11:00:10 AM: ❯ Version
11:00:10 AM:   @netlify/build 2.0.25
11:00:10 AM: ​
11:00:10 AM: ❯ Flags
11:00:10 AM:   deployId: 5efda20f345129a8dd19089d
11:00:10 AM:   mode: buildbot
11:00:10 AM: ​
11:00:10 AM: ❯ Current directory
11:00:10 AM:   /opt/build/repo
11:00:10 AM: ​
11:00:10 AM: ❯ Config file
11:00:10 AM:   /opt/build/repo/netlify.toml
11:00:10 AM: ​
11:00:10 AM: ❯ Context
11:00:10 AM:   production
11:00:10 AM: ​
11:00:10 AM: ❯ Loading plugins
11:00:10 AM:    - netlify-plugin-dotenv@1.0.1 from netlify.toml and package.json
11:00:11 AM: ​
11:00:11 AM: ┌──────────────────────────────────────────────────┐
11:00:11 AM: │ 1. onPreBuild command from netlify-plugin-dotenv │
11:00:11 AM: └──────────────────────────────────────────────────┘
11:00:11 AM: ​
11:00:11 AM: ​
11:00:11 AM: (netlify-plugin-dotenv onPreBuild completed in 7ms)
11:00:11 AM: ​
11:00:11 AM: ┌────────────────────────────────────┐
11:00:11 AM: │ 2. build.command from netlify.toml │
11:00:11 AM: └────────────────────────────────────┘
11:00:11 AM: ​
11:00:11 AM: $ npm run build
11:00:11 AM: > netlify-demo@ build /opt/build/repo
11:00:11 AM: > node build.js
11:00:11 AM: abc
11:00:11 AM: ​
11:00:11 AM: (build.command completed in 324ms)
11:00:11 AM: ​
11:00:11 AM: ┌─────────────────────────────┐
11:00:11 AM: │   Netlify Build Complete    │
11:00:11 AM: └─────────────────────────────┘
11:00:11 AM: ​
11:00:11 AM: (Netlify Build completed in 733ms)
11:00:11 AM: Caching artifacts
11:00:11 AM: Started saving node modules
11:00:11 AM: Finished saving node modules
11:00:11 AM: Started saving build plugins
11:00:11 AM: Finished saving build plugins
11:00:11 AM: Started saving pip cache
11:00:11 AM: Finished saving pip cache
11:00:11 AM: Started saving emacs cask dependencies
11:00:11 AM: Finished saving emacs cask dependencies
11:00:11 AM: Started saving maven dependencies
11:00:11 AM: Finished saving maven dependencies
11:00:11 AM: Started saving boot dependencies
11:00:11 AM: Finished saving boot dependencies
11:00:11 AM: Started saving go dependencies
11:00:11 AM: Finished saving go dependencies
11:00:14 AM: Build script success
11:00:14 AM: Starting to deploy site from '/'
11:00:14 AM: Creating deploy tree 
11:00:14 AM: Creating deploy upload records
11:00:14 AM: 4 new files to upload
11:00:14 AM: 0 new functions to upload
11:00:23 AM: Starting post processing
11:00:23 AM: Post processing - HTML
11:00:23 AM: Post processing - redirect rules
11:00:23 AM: Post processing - header rules
11:00:24 AM: Post processing done
11:00:24 AM: Site is live
11:00:25 AM: Finished processing build request in 24.685853709s

[ehmicky]

Hi @krotovic,

What's your version of Netlify CLI? Upgrading might help solving this problem.
If not, please copy and paste the output of netlify build --debug and we can debug why this is not working.

[krotovic]

@ehmicky I will try it later today. It's interesting though that it worked on Netlify as expected.

[erquhart]

@krotovic using a private repo is better than public, but committing .env is still something we don't want to make super easy.

For folks who understand the security risk and want to use this pattern, they can still use your plugin as an npm package, but I wouldn't be comfortable adding it as a one-click install at this point. Hope that makes sense.

Closing, but please comment with any questions.

[ehmicky]

I agree with @erquhart that there are security concerns with this approach that we don't want to encourage.

Please feel free to continue the discussion here on your problem running this plugin locally though. I think upgrading Netlify CLI should solve it. Please let us know if not.

I have also added few issues in your repository about best practices.

Even though this plugin won't be available through the UI, Netlify users can still install it using npm install and adding it to their netlify.toml. Some users in netlify/build#1514 were asking for .env support, so they would most likely be interested in your plugin.

[verythorough]

@krotovic if you do decide to troubleshoot running your plugin locally, I think it could be cool if you added a default mode that only accesses .env in local builds, then require a setting in inputs to allow it to run on Netlify as well. (h/t to @ehmicky for this idea!)

It adds a little complexity, and people wanting to use your plugin the way you do (in Netlify CI) would have to add the inputs field to their netlify.toml file, but the tradeoff is that the plugin would get a bigger audience by being in the UI.