Docs

Environments ​

You want your stable builds on production values and everything else kept away from them. There are exactly two environments, production and staging, and every build is stamped with one of them.

The default binding ​

EnvironmentBound channels
productionstable
stagingEvery other channel

A channel with no explicit binding resolves to staging, so a channel you create starts on staging values rather than on production secrets. Bindings live in Project settings, Channels.

Scoping a variable ​

A variable is set in Project settings, Environment with one of three scopes:

  • All channels: the value applies wherever the project builds
  • production: only builds for channels bound to production
  • staging: only builds for channels bound to staging

Keys match ^[A-Z0-9_]+$: uppercase letters, digits and underscores, nothing else. An API base URL usually differs per environment, a public analytics key usually does not. Scope each accordingly instead of duplicating values.

The environment stamp and promotion ​

The build is stamped with the environment it was built in. Promote refuses a build whose stamp does not match the target channel's binding, so a staging build cannot slide into stable carrying staging values. See Promote gates.

Promotion never re-runs a build. If a value must differ between two channels bound to different environments, the build has to happen for the target channel, not be promoted into it.

Reading values at build time ​

Variables reach the build as process environment variables. Whatever the build inlines is readable in the shipped extension, so treat every value that reaches client code as public, regardless of environment.

DANGER

Do not put store credentials or signing keys in environment variables. Store credentials belong in Project settings, Stores, where the project holds them and the build never sees them.

When it fails ​

  • Promote to stable is refused. The build is stamped staging. Build for a production-bound channel, then promote. See Promote gates.
  • A variable will not save. The key fails ^[A-Z0-9_]+$. Uppercase it and replace dashes and dots with underscores.
  • A value is missing from a build. Its scope does not cover the channel the build ran for. Check whether it sits in the other environment, or move it to all channels.
  • A secret shipped inside the extension. The build inlined it, and no environment scoping prevents that. Rotate the secret and move the work that needs it server side.

Next ​