use doppler

.github/workflows/continuous-release.yml

@@ -45,6 +45,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     needs: [lint, typecheck]
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -58,18 +61,26 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Install 1Password CLI
-        uses: 1password/install-cli-action@v1
+      - name: Install Doppler CLI
+        uses: dopplerhq/cli-action@v3
+
+      - name: Get OIDC token
+        run: |
+          TOKEN=$(curl -s -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://github.com/$GITHUB_REPOSITORY_OWNER")
+          echo "OIDC_TOKEN=$(echo $TOKEN | jq -r '.value')" >> $GITHUB_ENV
+
+      - name: Authenticate with Doppler
+        run: |
+          doppler oidc login --scope=. --identity=${{ vars.DOPPLER_SERVICE_IDENTITY_ID }} --token=$OIDC_TOKEN
+          doppler configure set project proofkit
+          doppler configure set config test
 
       - name: Run Unit Tests
-        run: op run --env-file=op.env -- pnpm test
-        env:
-          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+        run: pnpm test
 
       - name: Run fmodata E2E Tests
-        run: op run --env-file=op.env -- pnpm --filter @proofkit/fmodata test:e2e:ci
-        env:
-          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+        run: pnpm --filter @proofkit/fmodata test:e2e
 
   build:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -44,18 +44,26 @@ jobs:
       - name: Type Check
         run: pnpm typecheck
 
-      - name: Install 1Password CLI
-        uses: 1password/install-cli-action@v1
+      - name: Install Doppler CLI
+        uses: dopplerhq/cli-action@v3
+
+      - name: Get OIDC token
+        run: |
+          TOKEN=$(curl -s -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://github.com/$GITHUB_REPOSITORY_OWNER")
+          echo "OIDC_TOKEN=$(echo $TOKEN | jq -r '.value')" >> $GITHUB_ENV
+
+      - name: Authenticate with Doppler
+        run: |
+          doppler oidc login --scope=. --identity=${{ vars.DOPPLER_SERVICE_IDENTITY_ID }} --token=$OIDC_TOKEN
+          doppler configure set project proofkit
+          doppler configure set config test
 
       - name: Run Tests
-        run: op run --env-file=op.env -- pnpm test
-        env:
-          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+        run: pnpm test
 
       - name: Run fmodata E2E Tests
-        run: op run --env-file=op.env -- pnpm --filter @proofkit/fmodata test:e2e:ci
-        env:
-          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+        run: pnpm --filter @proofkit/fmodata test:e2e
 
   release:
     name: Release

CONTRIBUTING.md

@@ -0,0 +1,72 @@
+# Contributing to ProofKit
+
+## Getting Started
+
+### Prerequisites
+
+- Node.js >= 18
+- pnpm (managed via corepack)
+- [Doppler CLI](https://docs.doppler.com/docs/install-cli) for secrets management
+
+### Setup
+
+1. Clone the repository and install dependencies:
+
+```bash
+git clone https://github.com/proofgeist/proofkit.git
+cd proofkit
+corepack enable
+pnpm install
+```
+
+2. Install and configure Doppler:
+
+```bash
+# Install Doppler CLI
+brew install dopplerhq/cli/doppler  # macOS
+# or: curl -Ls https://cli.doppler.com/install.sh | sh  # Linux
+
+# Login to Doppler
+doppler login
+
+# Setup project (select proofkit project, dev config)
+doppler setup
+```
+
+### Running Tests
+
+Test scripts automatically use `doppler run` to inject secrets:
+
+```bash
+# Run all tests
+pnpm test
+
+# Run specific package tests
+pnpm --filter @proofkit/fmodata test
+pnpm --filter @proofkit/fmodata test:e2e
+```
+
+### Building
+
+```bash
+pnpm build
+```
+
+### Linting and Formatting
+
+```bash
+pnpm lint
+pnpm format
+```
+
+## Development Workflow
+
+1. Create a new branch for your feature or fix
+2. Make your changes
+3. Run tests with `pnpm test:local`
+4. Run `pnpm lint` to check for issues
+5. Submit a pull request
+
+## Code Style
+
+This project uses [Ultracite](https://github.com/proofgeist/ultracite) for linting and formatting. Run `pnpm dlx ultracite fix` to auto-fix issues before committing.

doppler.yaml

@@ -0,0 +1,3 @@
+setup:
+  project: proofkit
+  config: test

package.json

@@ -12,7 +12,7 @@
     "sherif": "pnpm dlx sherif@latest",
     "sherif:fix": "pnpm sherif --fix",
     "release": "turbo run build --filter={./packages/*} && changeset publish",
-    "test": "vitest",
+    "test": "turbo run test",
     "knip": "knip",
     "prepare": "husky"
   },

packages/better-auth/package.json

@@ -6,7 +6,7 @@
   "main": "dist/esm/index.js",
   "scripts": {
     "dev": "pnpm build:watch",
-    "test": "vitest run",
+    "test": "doppler run -c test_betterauth -- vitest run",
     "typecheck": "tsc --noEmit",
     "build": "vite build && publint --strict",
     "build:watch": "vite build --watch",

packages/better-auth/tests/adapter.test.ts

@@ -51,7 +51,7 @@ describe("My Adapter Tests", async () => {
         }
       }
     }
-  });
+  }, 60_000);
 
   if (!process.env.FM_SERVER) {
     throw new Error("FM_SERVER is not set");

packages/better-auth/vitest.config.ts

@@ -1,13 +1,7 @@
 import { defineConfig } from "vitest/config";
-// import dotenv from "dotenv";
-// import path from "path";
-
-// // Load .env.local file explicitly
-// dotenv.config({ path: path.resolve(__dirname, ".env.local") });
 
 export default defineConfig({
   test: {
     testTimeout: 15_000, // 15 seconds, since we're making a network call to FM
-    setupFiles: ["./tests/setupEnv.ts"],
   },
 });

packages/cli/package.json

@@ -51,7 +51,7 @@
     "pub:beta": "NODE_ENV=production pnpm build && npm publish --tag beta --access public",
     "pub:next": "NODE_ENV=production pnpm build && npm publish --tag next --access public",
     "pub:release": "NODE_ENV=production pnpm build && npm publish --access public",
-    "test": "vitest run"
+    "test": "doppler run -c test_cli -- vitest run"
   },
   "dependencies": {
     "@better-fetch/fetch": "1.1.17",

packages/cli/tests/browser-apps.test.ts

@@ -14,7 +14,7 @@ describe("Non-Interactive CLI Tests", () => {
   // Parse test environment variables
   const testEnv = z
     .object({
-      OTTO_SERVER_URL: z.string().url(),
+      OTTO_SERVER_URL: z.url(),
       OTTO_ADMIN_API_KEY: z.string().min(1),
       FM_DATA_API_KEY: z.string().min(1),
       FM_FILE_NAME: z.string().min(1),

packages/cli/vitest.config.ts

@@ -1,10 +1,5 @@
-import path from "node:path";
-import dotenv from "dotenv";
 import { defineConfig } from "vitest/config";
 
-// Load test environment variables
-dotenv.config({ path: path.resolve(__dirname, ".env.test") });
-
 export default defineConfig({
   test: {
     globals: true,

packages/fmdapi/package.json

@@ -44,9 +44,8 @@
     "format": "biome format --write .",
     "dev": "tsc --watch",
     "ci": "pnpm build && pnpm check-format && pnpm publint --strict && pnpm test",
-    "test": "vitest run",
+    "test": "doppler run -- vitest run",
     "typecheck": "tsc --noEmit",
-    "setup-env": "op inject -i ../../op.env -o .env.local -f",
     "changeset": "changeset",
     "release": "pnpm build && changeset publish --access public",
     "knip": "knip",

packages/fmdapi/tests/setup.ts

@@ -1,9 +1,6 @@
-import dotenv from "dotenv";
 import type { OttoFMSAPIKey } from "../src/adapters/otto";
 import { DataApi, FetchAdapter, OttoAdapter } from "../src/index";
 
-dotenv.config({ path: ".env.local" });
-
 if (!(process.env.FM_SERVER && process.env.FM_DATABASE && process.env.OTTO_API_KEY)) {
   throw new Error("FM_SERVER, FM_DATABASE, and OTTO_API_KEY must be set in the environment");
 }

packages/fmodata/package.json

@@ -21,21 +21,17 @@
   "scripts": {
     "build": "tsc && vite build && publint --strict",
     "build:watch": "tsc && vite build --watch",
-    "check-format": "biome format --check .",
-    "format": "biome format --write .",
     "lint": "biome check . --write",
     "lint:summary": "biome check . --reporter=summary",
-    "lint:fix": "pnpm lint --fix",
     "dev": "tsc --watch",
-    "test": "vitest run --typecheck",
+    "test": "doppler run -- vitest run --typecheck",
     "typecheck": "tsc --noEmit",
     "test:typecheck": "vitest run --typecheck",
     "test:watch": "vitest --typecheck",
     "test:build": "pnpm build && TEST_BUILD=true vitest run --typecheck",
     "test:watch:build": "TEST_BUILD=true vitest --typecheck",
-    "test:e2e": "op inject -i ../../op.env -o .env.local -f && vitest run tests/e2e.test.ts",
-    "test:e2e:ci": "vitest run tests/e2e.test.ts",
-    "capture": "op inject -i ../../op.env -o .env.local -f && tsx scripts/capture-responses.ts",
+    "test:e2e": "doppler run -- vitest run tests/e2e.test.ts",
+    "capture": "doppler run -- tsx scripts/capture-responses.ts",
     "knip": "knip",
     "pub:alpha": "bun run scripts/publish-alpha.ts",
     "global:link": "pnpm link --global"

packages/fmodata/tests/e2e/setup.ts

@@ -5,13 +5,9 @@
  * used across all E2E test files.
  */
 
-import path from "node:path";
 import { fmTableOccurrence, textField, timestampField } from "@proofkit/fmodata";
-import { config } from "dotenv";
 import { z } from "zod/v4";
 
-config({ path: path.resolve(__dirname, "../../.env.local") });
-
 // Load environment variables
 export const serverUrl = process.env.FMODATA_SERVER_URL;
 export const apiKey = process.env.FMODATA_API_KEY;

packages/typegen/package.json

@@ -8,10 +8,9 @@
     "dev": "pnpm build:watch",
     "dev:ui": "concurrently -n \"web,api\" -c \"cyan,magenta\" \"pnpm -C web dev\" \"pnpm run dev:api\"",
     "dev:api": "concurrently -n \"build,server\" -c \"cyan,magenta\" \"pnpm build:watch\" \"nodemon --watch dist/esm --delay 1 --exec 'node dist/esm/cli.js ui --port 3141 --no-open'\"",
-    "test": "vitest run",
+    "test": "doppler run -- vitest run",
     "test:watch": "vitest --watch",
     "typecheck": "tsc --noEmit",
-    "setup-env": "op inject -i ../../op.env -o .env.local -f",
     "build": "pnpm -C web build && pnpm vite build && node scripts/build-copy.js && publint --strict",
     "build:watch": "vite build --watch",
     "ci": "pnpm run build && pnpm run test",

packages/typegen/tests/setupEnv.ts

@@ -1,10 +1,4 @@
-import path from "node:path";
-import dotenv from "dotenv";
-
-// Load .env.local from the parent directory (packages/typegen) relative to this setup file (packages/typegen/tests)
-dotenv.config({ path: path.resolve(__dirname, "../.env.local") });
-
-console.log("SetupEnv: Loading .env.local from", path.resolve(__dirname, "../.env.local"));
+// Environment variables are injected by doppler run
 console.log("SetupEnv: DIFFERENT_FM_SERVER=", process.env.DIFFERENT_FM_SERVER ? "Loaded" : "Not Loaded");
 console.log("SetupEnv: DIFFERENT_FM_DATABASE=", process.env.DIFFERENT_FM_DATABASE ? "Loaded" : "Not Loaded");
 console.log("SetupEnv: DIFFERENT_OTTO_API_KEY=", process.env.DIFFERENT_OTTO_API_KEY ? "Loaded" : "Not Loaded");

turbo.json

@@ -18,8 +18,20 @@
       "dependsOn": ["^build"]
     },
     "test": {
-      "outputs": ["coverage/**"],
-      "dependsOn": []
+      "inputs": [
+        "$TURBO_DEFAULT$",
+        "vitest.config.*",
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx"
+      ],
+      "outputs": [],
+      "dependsOn": ["^build"]
+    },
+    "test:watch": {
+      "cache": false,
+      "persistent": true
     },
     "typecheck": {
       "dependsOn": ["^build"],