[discussion] Support `.env.example` for Function templates

[dkundel]

Right now github.com/twilio-labs/function-templates uses .env files for each template to specify which environment variables are needed. @thorsten-stripe pointed out correctly that that might be dangerous as people might push secrets accidentally. We could switch this to .env.example files but I'm concerned how we could do a transition where we don't break older versions of this tool.

[philnash]

Hmm... this is difficult. A create-twilio-function generated project will come with a .gitignore that includes .env.

Are you suggesting that twilio-run, when downloading a template, saves the .env file from the template as .env.example? Or that all function-templates should change to .env.example?

[thorsten-stripe]

I was thinking the latter: every function template should have an .env.example file and when set up with twilio-run it is turned into a .env file while at the same time the .gitignore file is generated.

The main concern is that someone clones the function-templates directly from Github without twilio-run and enter their secrets in the .env file while there is no gitignore excluding .env then causing them to accidentally commit their secrets to git.

My rule of thumb is: no project on GitHub should have a .env file ever and .env should always be included in the .gitignore for every project. Does that make sense?

[philnash]

Ah, I get you. The issue with that is that all existing copies of twilio-run that are out there expect there to be a .env file to be downloaded.

I can't think of a way to change this without breaking those old versions. Unless there is a way to enforce a file redirect within GitHub?

Any ideas?

[dkundel]

That's basically why I spawned this thread. I can't think of any good solution here but I'd like to solve this problem.
The only two approaches that I see are both applied in the function-templates repository:

1. A pre-commit hook that makes you confirm that you are not accidentally committing any variables you don't intend to
2. Creating a development branch and creating a GitHub action that automatically sync's into master by renaming .env.example files to .env. We would make development our default branch so when you visit github.com/twilio-labs/function-templates it would show development instead

[philnash]

The update to this is that we are waiting to switch twilio-labs/function-templates from master to main branch and we will make this change along with that.