process.env respect .env file, but @env can grab from anything

Author: motdotla

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 ### Fixed
 
-- `process.env.X` is only inlined when `X` comes from a `.env` file (or `NODE_ENV` / `BABEL_ENV` / `envName`). Host/build tooling vars like `JEST_WORKER_ID` no longer leak into the app bundle ([#574](https://github.com/dotenvx/react-native-dotenv/issues/574)).
+- `process.env.X` is only inlined when `X` is defined in a `.env` file (plus `NODE_ENV` / `BABEL_ENV` / `envName`). Stops build-tooling leaks into the bundle without hardcoding tool-specific names. Host/CI-only values still work through `@env` imports ([#574](https://github.com/dotenvx/react-native-dotenv/issues/574)).
 
 ### Removed
 

README.md

@@ -164,9 +164,7 @@ Prevent these env variable names from being imported.
 </details>
 <details><summary><code>safe</code> (default: <code>false</code>)</summary><br>
 
-Only allow environment variables defined in the `.env` file. This completely ignores everything already defined in the environment.
-
-The `.env` file has to exist.
+Only allow variables defined in your `.env` files. Host environment variables can still override values for those same keys at build time, but keys that exist only in the environment (and not in `.env`) are not imported.
 
 ```json
 {
@@ -228,7 +226,9 @@ console.log(`Hello ${process.env.HELLO}`)
 fetch(`${process.env.API_URL}/users`)
 ```
 
-Only keys present in your `.env` files are inlined (plus `NODE_ENV` / `BABEL_ENV` / `envName`). Other host environment variables — including build-tooling vars like `JEST_WORKER_ID` — are left alone so they do not leak into the app bundle.
+`process.env.X` is only inlined when `X` is in your `.env` files (plus `NODE_ENV` / `BABEL_ENV` / `envName`). That keeps build-tooling noise out of the bundle without special-casing tool names.
+
+For host/CI-only values, use `@env` imports — or put the key in `.env` and let CI override the value.
 
 </details>
 <details><summary>Expo</summary><br>
@@ -492,8 +492,9 @@ Prefer [Zod](https://zod.dev) to validate and infer types — see Types with Zod
 
 By default, we will never modify any environment variables that have already been set. In particular, if there is a variable in your `.env` file which collides with one that already exists in your environment, then that variable will be skipped (the existing value wins at build time).
 
-</details>
+`process.env.X` is only inlined when `X` appears in a `.env` file. Host/CI-only keys still work via `import { X } from '@env'`.
 
+</details>
 &nbsp;
 
 ## CHANGELOG

index.js

@@ -94,12 +94,12 @@ module.exports = (api, options) => {
   const modeExceptions = ['NODE_ENV', 'BABEL_ENV', options.envName]
   const fileEnv = undefObjectAssign(undefObjectAssign(undefObjectAssign(parsed, modeParsed), localParsed), modeLocalParsed)
 
-  // Keys that may be inlined for process.env.X — only what came from .env files,
-  // plus mode-selection exceptions. Prevents host/build tooling vars (e.g.
-  // JEST_WORKER_ID from Metro's jest-worker) from leaking into the app bundle.
-  const inlineKeys = new Set(Object.keys(fileEnv))
+  // process.env.X is only inlined for keys from .env files (+ mode exceptions).
+  // That stops build-tooling pollution (e.g. Metro jest-worker) without hardcoding
+  // tool-specific names. Host/CI values still flow through @env imports below.
+  const processEnvInlineKeys = new Set(Object.keys(fileEnv))
   for (const exception of modeExceptions) {
-    inlineKeys.add(exception)
+    processEnvInlineKeys.add(exception)
   }
 
   env = (options.safe)
@@ -161,7 +161,7 @@ module.exports = (api, options) => {
         const key = filepath.toComputedKey()
         if (t.isStringLiteral(key)) {
           const importedId = key.value
-          if (!inlineKeys.has(importedId)) {
+          if (!processEnvInlineKeys.has(importedId)) {
             return
           }
           const value = Object.hasOwn(env, importedId) ? env[importedId] : process.env[importedId]

tests/index.test.js

@@ -175,29 +175,32 @@ describe('react-native-dotenv', () => {
     expect(code).toBe('console.log("abc123456");\nconsole.log("username123456");')
   })
 
-  // #574 — Metro/jest-worker sets JEST_WORKER_ID on transform workers. Only keys
-  // from .env files (plus NODE_ENV/BABEL_ENV/envName) may be inlined for process.env.X.
-  it('should not inline host-only process.env vars like JEST_WORKER_ID', () => {
+  // #574 — process.env.X only inlines keys from .env (no host-only / tooling leaks).
+  it('should not inline process.env keys that are absent from .env', () => {
     process.env.JEST_WORKER_ID = '123'
+    process.env.MY_CI_VAR = 'from-ci'
 
-    const { code } = transformSync('console.log(process.env.JEST_WORKER_ID)', {
-      configFile: false,
-      babelrc: false,
-      plugins: [[require('../index.js'), { path: FIXTURES + 'default/.env' }]]
-    })
+    const { code } = transformSync(
+      'console.log(process.env.JEST_WORKER_ID);\nconsole.log(process.env.MY_CI_VAR);',
+      {
+        configFile: false,
+        babelrc: false,
+        plugins: [[require('../index.js'), { path: FIXTURES + 'default/.env' }]]
+      }
+    )
 
-    expect(code).toBe('console.log(process.env.JEST_WORKER_ID);')
+    expect(code).toBe('console.log(process.env.JEST_WORKER_ID);\nconsole.log(process.env.MY_CI_VAR);')
   })
 
-  it('should still inline process.env keys that are defined in .env', () => {
-    process.env.JEST_WORKER_ID = 'from-host'
+  it('should still allow @env imports from host/CI without the key in .env', () => {
+    process.env.MY_CI_VAR = 'from-ci'
 
-    const { code } = transformSync('console.log(process.env.API_KEY)', {
+    const { code } = transformSync('import { MY_CI_VAR } from "@env";\nconsole.log(MY_CI_VAR);', {
       configFile: false,
       babelrc: false,
       plugins: [[require('../index.js'), { path: FIXTURES + 'default/.env' }]]
     })
 
-    expect(code).toBe('console.log("abc123");')
+    expect(code).toBe('console.log("from-ci");')
   })
 })