add dotenv support to wrangler secret bulk

[Ankcorn]

Fixes #6388

Adds support for env files in all the secret bulk commands

Questions for the team:

currently the parsing is toggled between JSON and env by adding a flag --experimental-env-file.
Should this be made "no config" by trying to parse both and seeing which succeeds?

Will update the docs once the flag stuff is confirmed

---

• Tests
  • TODO (before merge)
  • Tests included
  • Tests not necessary because:
• E2E Tests CI Job required? (Use "e2e" label or ask maintainer to run separately)
  • I don't know
  • Required
  • Not required because: changes don't require workers and can be effectively unit tested
• Public documentation
  • TODO (before merge)
  • Cloudflare docs PR(s): Docs for wrangler secret bulk env support cloudflare-docs#19056
  • Documentation not necessary because:

[changeset-bot]

🦋 Changeset detected

Latest commit: 3bd3768

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
wrangler	Minor
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

A wrangler prerelease is available for testing. You can install this latest build in your project with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-wrangler-7674

You can reference the automatically updated head of this PR with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/prs/7674/npm-package-wrangler-7674

Or you can use npx with this latest build directly:

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-wrangler-7674 dev path/to/script.js

Additional artifacts:

wget https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-workers-bindings-extension-7674 -O ./cloudflare-workers-bindings-extension.0.0.0-v7d1f2fb5d.vsix && code --install-extension ./cloudflare-workers-bindings-extension.0.0.0-v7d1f2fb5d.vsix

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-create-cloudflare-7674 --no-auto-update

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-kv-asset-handler-7674

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-miniflare-7674

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-pages-shared-7674

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-unenv-preset-7674

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-vitest-pool-workers-7674

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-workers-editor-shared-7674

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-workers-shared-7674

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12695830110/npm-package-cloudflare-workflows-shared-7674

Note that these links will no longer work once the GitHub Actions artifact expires.

---

wrangler@3.100.0 includes the following runtime dependencies:

Package	Constraint	Resolved
miniflare	workspace:*	3.20241230.0
workerd	1.20241230.0	1.20241230.0
workerd --version	1.20241230.0	2024-12-30

Please ensure constraints are pinned, and miniflare/workerd minor versions match.

[irvinebroque]

So this is basically

Before: you can pass wrangler secret bulk a path to a file, but has to be JSON

After: you can pass wrangler secret bulk a path to a file, and that file can be either JSON, or KEY=VALUE ala env vars

...making it easy to go "I have a .env file, I want to add all of it to secrets.
...but not coupling it specifically to the filename .env, or to dotenv behaviors, etc.

Correct?

[Ankcorn]

So this is basically

Before: you can pass wrangler secret bulk a path to a file, but has to be JSON

After: you can pass wrangler secret bulk a path to a file, and that file can be either JSON, or KEY=VALUE ala env vars

...making it easy to go "I have a .env file, I want to add all of it to secrets. ...but not coupling it specifically to the filename .env, or to dotenv behaviors, etc.

Correct?

Exactly

[penalosa]

So this is basically

Before: you can pass wrangler secret bulk a path to a file, but has to be JSON

After: you can pass wrangler secret bulk a path to a file, and that file can be either JSON, or KEY=VALUE ala env vars

...making it easy to go "I have a .env file, I want to add all of it to secrets. ...but not coupling it specifically to the filename .env, or to dotenv behaviors, etc.

Correct?

In Wrangler's case, I think it'd likely be a case of having a .dev.vars file which you want to upload

[penalosa]

Could you expand this with an example, and call out .dev.vars?

[penalosa]

Suggested change

	json The file of key-value pairs to upload, as JSON in form {\\"key\\": value, ...} or .env file in the form KEY=VALUE [string]
	json The file of key-value pairs to upload, as JSON in form {\\"key\\": value, ...} or .dev.vars file in the form KEY=VALUE [string]

[irvinebroque]

currently the parsing is toggled between JSON and env by adding a flag --experimental-env-file. Should this be made "no config" by trying to parse both and seeing which succeeds?

I'm having a hard time seeing a reason not to do that — you give us file, we detect format