.env files on eas side

[stephanepx]

Hi guys !
Thanks a lot for this awesome repository !
My team and I are wondering why we are facing this error in our EAS Build :

❌ Invalid environment variables: { SENTRY_ORG: [ 'Required' ], SENTRY_PROJECT: [ 'Required' ] }
❌ Missing variables in .env.staging file, Make sure all required variables are defined in the .env.staging file.
💡 Tip: If you recently updated the .env.staging file and the error still persists, try restarting the server with the -c flag to clear the cache.

We recently add Sentry and follow your guide.

So in env.js we have this :

const client = z.object({
  APP_ENV: z.enum(['development', 'staging', 'production']),
  NAME: z.string(),
  SCHEME: z.string(),
  BUNDLE_ID: z.string(),
  PACKAGE: z.string(),
  VERSION: z.string(),
  SLUG: z.string(),
  SENTRY_DSN: z.string().min(1, 'SENTRY_DSN is required'),
});

const buildTime = z.object({
  EXPO_ACCOUNT_OWNER: z.string(),
  EAS_PROJECT_ID: z.string(),
  SENTRY_ORG: z.string().min(1, 'SENTRY_ORG is required'),
  SENTRY_PROJECT: z.string().min(1, 'SENTRY_PROJECT is required'),
});

const _clientEnv = {
  SLUG,
  APP_ENV,
  NAME: NAME,
  SCHEME: SCHEME,
  BUNDLE_ID,
  PACKAGE,
  VERSION: packageJSON.version,
  SENTRY_DSN: process.env.SENTRY_DSN,
};

const _buildTimeEnv = {
  EXPO_ACCOUNT_OWNER,
  EAS_PROJECT_ID,
  SENTRY_PROJECT: process.env.SENTRY_PROJECT,
  SENTRY_ORG: process.env.SENTRY_ORG,
};

And in our eas-build-qa.yml we have :

name: EAS QA Build (Android & IOS) (EAS)

on:
  workflow_dispatch:
  release:
    types: [published]

jobs:
  Build:
    name: EAS QA Build (Android & IOS) (EAS)
    runs-on: ubuntu-latest
    steps:
      - name: Check for EXPO_TOKEN
        run: |
          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
            exit 1
          fi
      - name: 📦 Checkout project repo
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: 📦 Setup Node + PNPM + install deps
        uses: ./.github/actions/setup-node-pnpm-install

      - name: Create environment file
        uses: SpicyPizza/[email protected]
        with:
          file_name: .env.staging
          envkey_SENTRY_ORG: ${{ vars.SENTRY_ORG }}
          envkey_SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT }}
          envkey_SENTRY_DSN: ${{ secrets.SENTRY_DSN }}

      - name: ⏱️ EAS Build
        uses: ./.github/actions/eas-build
        with:
          APP_ENV: staging
          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
          VERSION: ${{ github.event.release.tag_name }}

We also added SENTRY_ORG & SENTRY_PROJECT in Github variables (we tried also with secrets)
And we added EXPO_TOKEN & SENTRY_DSN in Github Secrets

It seems that EAS build can't have access to this .env.file

Do you have any idea how we can handle this ?

Thanks !

[hamzamekk]

hello @stephanepx did u followed this tuto for sentry ? https://starter.obytes.com/recipes/sentry-setup/

[stephanepx]

Hi @hamzamekk !
Yes absolutely! And it is working on local, but EAS doesn't seems to have access to .env.staging file

[yjose]

The error indicates that those environment variables do not exist while building the app on EAS. A simple workaround for now is to add those variables to EAS secret too.

But just a few questions to check what's going on:

• Are you adding .env.staging to gitignore?
• Did you try to trigger the build from your local machine (mainly using the same command you are using in GitHub CI) from your machine?

I am thinking of maybe adding an env.staging file on the fly (SpicyPizza/create-envfile)and having it in the .gitignore so it will not be uploaded to EAS.

[stephanepx]

Hey @yjose
Yes I added .env.staging to gitignore
I also tried to build from my local machine but the result is the same

I used SpicyPizza/create-envfile to create the .env.staging on the fly but it seems that EAS can't have access to it...

Will try to add secrets to EAS secrets, but do you know how to call this SENTRY_PROJECT secret in workflow file ?
With github we are using secrets.SENTRY_PROJECT, what should be the name with EAS ?

Thanks a lot !!

[yjose]

@stephanepx Thank you for answering my question. Apparently, EAS will not upload files that exist in .gitignore and that's the problem, for now i am not sure how to fix this, but will check it after

Regarding EAS secrets, you just need to add them, and they will work automatically. EAS build has nothing to do with GitHub workflows, so keep everything as it is and add your vars to EAS secret, and the build should work as expected.

EAS will add all secret as global variables so they will be available as keys in process.env ( as we are using them in the evn.js)

[stephanepx]

@yjose Awesome thanks a lot ! We will do that for now !

[lukachi]

Does it means, that in that case - creating env files in ci is redudand? We just need to trigger first build locally and also publish secrets, right?

---

upd:

Added secrets to expo secrets, but EAS build still not see them, so at the moment when build reads app.config.ts (npx expo config) - secrets not in the process.env.

Tried add to eas.json under [environment].env the [SECRET_KEY]: "${APP_ENV}_SECRET_KEY" but it result in plain text in the app.

Also tried to remove NO_DOT_ENV, and it still not see my secrets

Furthermore the execution of run eas build locally - have not access to eas secrets, so that's why we should somehow add envs straight in cli command, for example using 'set-env', but it's not the solution i'm looking for :)

And finally CI/CD:

It feels bad when we need to manage secrets in gh secrets, local env files and also expo project secrets.
That's why maybe it would be better to not to create .env file on the fly in workflow files, cuz anyway it should just trigger build in eas build cloud.
But this results in executing app.config.ts in workflow and error of missing envs.

i wrote a script, that takes gitignored .env files and push them to expo secrets. It should simplify the flow of managing secrets.
The philosophy is to do the dev thing with .env.secret.${app_env} variables. And when you ready to build your app for distribution - run this script to push secrets. And they should be accessed in EAS cloud build.
For local eas build you could do the workaround with set-env (haven't found better solution)

here the script:

process.env.APP_ENV = process.env.APP_ENV || 'development'

const fs = require('fs')
const path = require('path')
const dotenv = require('dotenv')
const { execSync } = require('child_process')

const rootPath = path.resolve(__dirname, '../')

const envFiles = ['.env.secrets.development', '.env.secrets.staging', '.env.secrets.production']

const outputFilePath = '.env.secrets'
let combinedEnv = {}

envFiles.forEach(file => {
  if (fs.existsSync(file)) {
    const envConfig = dotenv.parse(fs.readFileSync(file))
    const envPrefix = path.basename(file).split('.')[3].toUpperCase()

    console.log(`Loaded ${file} with prefix ${envPrefix}`)

    Object.keys(envConfig).forEach(key => {
      combinedEnv[`${envPrefix}_${key}`] = envConfig[key]
    })
  }
})

const outputContent = Object.entries(combinedEnv)
  .map(([key, value]) => `${key}=${value}`)
  .join('\n')

fs.writeFileSync(outputFilePath, outputContent)

try {
  execSync('eas secret:push --scope project --env-file .env.secrets --force --non-interactive', {
    stdio: 'inherit',
  })
  console.log('Secrets pushed successfully.', JSON.stringify(combinedEnv, null, 2))
} catch (error) {
  console.error('Failed to push secrets:', error)
}

fs.unlinkSync(outputFilePath)
console.log(`Deleted ${outputFilePath}`)

---

Upd:

Indeed, a little workaround to make metro server, 'local eas build, server eas buildandci-cd` trigger of eas build works:

in env.js

...
const envPath = path.resolve(__dirname, `.env.${APP_ENV}`)
const secretEnvPath = path.resolve(__dirname, `.env.secrets.${APP_ENV}`)

require('dotenv').config({
  path: [envPath, secretEnvPath],
})
...
const getSecretWithSuffix = name => {
  const appEnvUppercase = APP_ENV.toUpperCase()

  return process.env[`${appEnvUppercase}_${name}`] || process.env[name]
}
...
const _clientEnv = {
  ...
  // ADD YOUR ENV VARS HERE TOO
  SECRET_1: getSecretWithSuffix('SECRET_1'),
  SECRET_2: getSecretWithSuffix('SECRET_2'),
  SOME_PUBLIC_KEY: process.env.SOME_PUBLIC_KEY,
}

this will handle both, local and server builds.

---

once you ready to use ci/cd, use the script to publish secrets.

add in eas-build action.yml before eas build

    - name: Create env file with stubs to pass expo config check, the real secrets will be injected in the EAS build process
      uses: SpicyPizza/[email protected]
      with:
        envkey_SECRET_KEY_1: DO_NOT_CHANGE
        envkey_SECRET_KEY_2: DO_NOT_CHANGE
        file_name: .env.secrets.${{ inputs.APP_ENV }}

And finally, copy .gitignore content to .easignore, but remove your .env.secrets.* out of there.

That's it, i've check it locally(metro dev and eas build), local-trigger and ci/cd trigger with different values