Proper way of using HEROKU_SLUG_COMMIT as a compile time constant

[cancan101]

I would like to use HEROKU_SLUG_COMMIT as a compile time constant. I am confused if I should follow https://github.com/mars/create-react-app-buildpack#user-content-add-on-config-vars as that mentions "set-up & use Runtime configuration to access the variables". Is there no way I can just access the constant as as constant? I'm not worried about that value changing between pipeline deploys as it is the git hash.

[mars]

This buildpack exposes REACT_APP_, NPM_, & NODE_ prefixed variables to the npm build process, documented in the README Architecture section.

So, use one of those three prefixes REACT_APP_, NPM_, or NODE_ and it will be available during the build.

I'm also open to exposing HEROKU_ prefix to the build process if one of the other prefixes does not work elegantly.

[cancan101]

The issue that I am having is that the Dyno metadata injects with that env var name so I don't control it. Maybe allow the HEROKU_ prefix? Someone else had been asking about this awhile ago: mars/create-react-app-inner-buildpack#6

[mars]

That makes sense @cancan101 , I will make that change, but cannot promise timing, so until then, the Add-on config vars technique should work to expose HEROKU_ vars as REACT_APP_HEROKU_ vars (or NODE_HEROKU_ if you don't want the values embedded into the React app).

[cancan101]

In order to use the add on technique, I have to access it as a runtime var using your npm package?

[mars]

Gosh, sorry for the confusion. You're right that only works for runtime.

For buildtime, try changing your app's package.json scripts.build command to:

{
  "scripts": {
    "build": "REACT_APP_HEROKU_SLUG_COMMIT=$HEROKU_SLUG_COMMIT react-scripts build"
  }
}

[cancan101]

will that work though or will the build pack keep that var from making it to the build command?

[mars]

You’re right, that won’t work either. Sorry I was really reaching to help you.

I guess the only fix is to add the HEROKU_ prefix to the export list.

[cancan101]

What's the rationale for the build pack to maintain a white list of env var prefixes when rca already filters what is passed in to the build?

[mars]

It’s part of Heroku architecture for security. Things like database credentials & API keys are stored in config vars, and simply exposing everything by default would undermine trust in the platform.

[cancan101]

Perhaps allow for a config file to specify extra white listed env prefixes so that you don't need to make code changes for future additions?

[mars]

I think I can carve out the time this weekend to add support for HEROKU_ vars & make a release, specifically to allow using dyno metadata in the build. Thanks for your patience & feedback @cancan101

[mars]

(Auto-closed from wrong PR)