Codestin Search App

dylanhuff-at-coder · 2026-06-25T19:35:13Z

Adds a file dropzone to the create branch of the Add secret dialog (final PR in the PLAT-240 stack, after #26723 and #26724). The browser reads the file, derives the format from the extension (.env/.json/.yaml/.yml), and imports via POST /secrets/batch; per-entry backend errors surface in an alert and the success toast flags secrets imported without an env name. Storybook play stories and vitests cover the flow.

Also documents the upload flow in docs/user-guides/user-secrets.md.

Closes https://linear.app/codercom/issue/PLAT-240

Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.

linear-code · 2026-06-25T19:35:17Z

PLAT-240

dylanhuff-at-coder · 2026-06-25T19:35:25Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

github-actions · 2026-07-23T16:34:01Z

Docs preview

Check off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here.

docs/user-guides/user-secrets.md

coderagents · 2026-07-27T15:11:05Z

Documentation Check

This push is another merge from main (d64fd0c053), with no new PR-authored
commits. The branch now carries the enable/disable feature (#27537) but is still
behind coder secret import (#27534), which lands overlapping content in the
same page.

Updates Needed

docs/user-guides/user-secrets.md - New: main added ### Import multiple secrets from a file (documenting coder secret import) in feat: add coder secret import for bulk secret files #27534, which is not yet on this branch. Once the branch picks it up, the page has two sections covering file import with conflicting detail: main's says the import "never overwrites existing secrets", while this PR's says a conflict cancels the import, and only main's mentions the CLI while only this PR's mentions the dashboard. Consolidate into one section covering the dashboard, coder secret import, and the API, and drop "To import secrets programmatically, use the Secrets API" as the only programmatic path.
docs/user-guides/user-secrets.md - After feat: add enable/disable support for user secrets #27537, ParseSecretsFile sets Enabled = false for keys that can't be env-injected, because user_secrets_enabled_requires_target forbids an enabled secret with no target. This PR's section still says such keys "are imported without an environment variable target" and are "not injected into workspaces until you add a valid environment variable or file target", omitting the disabled state and the required enable step. Main's CLI import text has the same gap, so fix it once in the consolidated section.
docs/user-guides/user-secrets.md - The section shows only plain KEY=VALUE, but codersdk.parseEnvSecrets implements a narrow dotenv subset with user-visible consequences. Document at least:
- export prefixes and full-line # comments are accepted.
- $VAR and ${VAR} are not expanded, so the literal text is stored.
- Inline comments are not stripped: PASS=abc#123 stores abc#123.
- Multiline values are unsupported in .env. Use JSON or YAML for PEM keys or certs.
- Duplicate keys are rejected (the error cites the line number) rather than last-wins.
⚠️ Was addressed in 1fa501ecaa, which the 28258da21c force-push removed.
docs/user-guides/user-secrets.md - "contain no more than 50 keys" reads as a per-file cap. 50 is the total-secrets-per-user cap (MaxUserSecretsPerUserCount), so a 50-key file fails whenever the user already owns any secrets.

⚠️ Was addressed in 1fa501ecaa, which the 28258da21c force-push removed.
docs/user-guides/user-secrets.md - "Manage secrets from the dashboard" lists add, update, delete, and the enable/disable toggle, but not import. Add import so the dashboard-only flow is discoverable from the section that describes the page.

⚠️ Was addressed in 1fa501ecaa, which the 28258da21c force-push removed.
~~docs/user-guides/user-secrets.md - Record the 255-character secret name cap in the ## Limits table~~ (no longer needed: MaxUserSecretNameLength came from b35020f9fa, which the 28258da21c force-push removed, so the cap exists neither on this branch nor on main)

Verification Notes

The d64fd0c053 merge parent is 1a6a8be96c, which predates feat: add coder secret import for bulk secret files #27534, so this PR does not delete docs/reference/cli/secret_import.md, its manifest entry, or the coder secret import CLI code. The branch is simply behind main there.
The remaining claims still check out: 1 MiB (MaxSecretsFileBytes), the 50-secret cap (MaxUserSecretsPerUserCount), string-only JSON/YAML values, atomic import, and the docs/reference/api/secrets.md#import-user-secrets-from-a-file anchor.
markdownlint-cli2, markdown-table-formatter --check, and an emdash/endash scan are clean on the page.

Automated review via Coder Agents

…240) Add a file-upload dropzone to the create branch of the Add secret dialog (edit is unchanged). The browser reads the file, derives the format from the extension, and calls the import endpoint, surfacing per-entry backend errors. Includes Storybook coverage for success, partial-failure, and unsupported-file cases.

…types

jeremyruppel · 2026-07-28T15:53:27Z

+									isUploading={isImporting}
+									file={importFile}
+									onUpload={handleImportFile}
+									onUnsupportedFile={handleImportFile}


feels kind of weird to overload this handler to support both valid and invalid filetypes. very much a nit but perhaps separating this out into two handlers would read better?

dylanhuff-at-coder mentioned this pull request Jun 25, 2026

feat: add user secrets file parser and shared validator (PLAT-240) #26723

Merged

dylanhuff-at-coder mentioned this pull request Jun 25, 2026

feat: add bulk user secret import endpoint and SDK client (PLAT-240) #26724

Merged

github-actions Bot assigned dylanhuff-at-coder Jun 25, 2026

dylanhuff-at-coder mentioned this pull request Jun 25, 2026

feat: bulk import user secrets from file #26640

Closed

github-actions Bot added the stale This issue is like stale bread. label Jul 5, 2026

github-actions Bot closed this Jul 9, 2026

dylanhuff-at-coder reopened this Jul 23, 2026

dylanhuff-at-coder force-pushed the dylan/plat-240-secrets-import-frontend branch from cd114ba to 22ab3cd Compare July 23, 2026 16:33

dylanhuff-at-coder changed the title ~~feat(site): add bulk secret import upload to Add secret dialog (PLAT-240)~~ feat: add bulk secret import upload to Add secret dialog (PLAT-240) Jul 23, 2026

dylanhuff-at-coder removed the stale This issue is like stale bread. label Jul 23, 2026

Base automatically changed from dylan/plat-240-secrets-import-endpoint to main July 23, 2026 21:55

dylanhuff-at-coder marked this pull request as ready for review July 27, 2026 15:07

dylanhuff-at-coder requested a review from a team as a code owner July 27, 2026 15:07

dylanhuff-at-coder requested a review from aslilac July 27, 2026 15:07

dylanhuff-at-coder mentioned this pull request Jul 27, 2026

feat: add coder secret import for bulk secret files #27534

Merged

dylanhuff-at-coder added 9 commits July 27, 2026 21:59

fix(site): surface secrets imported without env names in success toast

80f8f77

docs(docs/user-guides): document bulk secret import from the dashboard

cbb0ad6

fix(site): align secrets import copy and drop validation

8bba9ad

refactor(site): trim secrets import stories and comments

680c52b

docs(docs/user-guides): clarify secrets file import limits and value …

b1150fd

…types

fix(site/src): guard concurrent and oversized secret imports

ec6eb26

fix(site/src): keep secret import errors actionable

3af373e

refactor(site/src): focus secret import frontend changes

28258da

dylanhuff-at-coder force-pushed the dylan/plat-240-secrets-import-frontend branch from 44e6aae to 28258da Compare July 27, 2026 22:40

dylanhuff-at-coder requested a review from DanielleMaywood July 27, 2026 22:50

jeremyruppel reviewed Jul 28, 2026

View reviewed changes

jeremyruppel approved these changes Jul 28, 2026

View reviewed changes

Merge branch 'main' into dylan/plat-240-secrets-import-frontend

d64fd0c

dylanhuff-at-coder force-pushed the dylan/plat-240-secrets-import-frontend branch from 82f6740 to d64fd0c Compare July 28, 2026 22:20

dylanhuff-at-coder merged commit efbf802 into main Jul 28, 2026
30 of 31 checks passed

dylanhuff-at-coder deleted the dylan/plat-240-secrets-import-frontend branch July 28, 2026 22:30

github-actions Bot locked and limited conversation to collaborators Jul 28, 2026

Navigation Menu

Uh oh!

feat: add bulk secret import upload to Add secret dialog (PLAT-240) - #26725

feat: add bulk secret import upload to Add secret dialog (PLAT-240)#26725
dylanhuff-at-coder merged 10 commits into
mainfrom
dylan/plat-240-secrets-import-frontend

dylanhuff-at-coder commented Jun 25, 2026 •

edited

Loading

Uh oh!

linear-code Bot commented Jun 25, 2026

Uh oh!

dylanhuff-at-coder commented Jun 25, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

coderagents Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

jeremyruppel Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dylanhuff-at-coder commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear-code Bot commented Jun 25, 2026

Uh oh!

dylanhuff-at-coder commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docs preview

Uh oh!

coderagents Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Check

Updates Needed

Verification Notes

Uh oh!

jeremyruppel Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dylanhuff-at-coder commented Jun 25, 2026 •

edited

Loading

dylanhuff-at-coder commented Jun 25, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

coderagents Bot commented Jul 27, 2026 •

edited

Loading