[ENG-14822][steps] Coerce env in steps to string by szdziedzic · Pull Request #3583 · expo/eas-cli

szdziedzic · 2026-04-08T16:05:57Z

Why

Passing numeric values in workflow step env (e.g. env: { HOMEBREW_NO_AUTO_UPDATE: 1 }) results in a validation error because env values are required to be strings. YAML naturally parses unquoted numbers as numeric types, so users hit this unexpectedly.

How

Updated the Joi env validation schema in BuildFunctionCallSchema to accept both numbers and strings via Joi.alternatives().try(Joi.number(), Joi.string().allow('')), with a .custom() callback that coerces numbers to strings via String(value). This matches the coercion pattern used elsewhere in the codebase (e.g. stringLike in eas-cli).

Booleans and objects are still rejected — booleans because YAML accepts both True and true (coercing would lose casing), and objects because they aren't valid env values.

Test Plan

Updated existing error message assertions to match the new "must be one of [number, string]" validation message.
Added two new test cases verifying that numeric env values are coerced to strings for both run commands and function calls.
All 290 tests in the steps package pass.

linear · 2026-04-08T16:06:01Z

ENG-14822 Coerce `env` in steps to string

szdziedzic · 2026-04-08T16:06:10Z

[ENG-14822][steps] Coerce env in steps to string #3583 👈 (View in Graphite)
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Copilot

Pull request overview

This PR updates the build-steps config validation to accept numeric env values in step definitions and coerce them to strings during Joi validation, aligning config parsing with how environment variables are ultimately represented.

Changes:

Allow env values in step configs to be number | string, and coerce validated values to strings.
Update existing validation error-message assertions to match the new Joi alternatives type error.
Add tests to verify numeric env values are coerced to strings for both run steps and function-call steps.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/steps/src/BuildConfig.ts	Expands Joi schema for `env` values to accept numbers and coerces validated values to strings.
packages/steps/src/tests/BuildConfig-test.ts	Updates error expectations and adds tests covering number-to-string coercion for `env`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-08T16:09:20Z

packages/steps/src/BuildConfig.ts

+  env: Joi.object().pattern(
+    Joi.string(),
+    Joi.alternatives()
+      .try(Joi.number(), Joi.string().allow(''))


With Joi's default convert: true, Joi.number() will coerce numeric-looking strings (e.g. '001', '1e3') into numbers before the .custom(String) runs, which can silently change env values (leading zeros, scientific notation, etc.). To avoid mutating string inputs, make the number branch strict (e.g. Joi.number().strict()) or prefer the string alternative and only accept actual numbers without coercing strings to numbers.

Suggested change

.try(Joi.number(), Joi.string().allow(''))

.try(Joi.number().strict(), Joi.string().allow(''))

Copilot · 2026-04-08T16:09:20Z

packages/steps/src/__tests__/BuildConfig-test.ts

+                    command: 'echo 123',
+                    env: {
+                      HOMEBREW_NO_AUTO_UPDATE: 1,
+                    },
+                  },


Consider adding a regression test that a numeric-like string env value (e.g. PORT: '001') remains unchanged after validation. This will catch unintended Joi conversion where strings are coerced into numbers and then stringified, potentially losing formatting.

szdziedzic · 2026-04-08T16:10:26Z

/changelog-entry bug-fix [steps] Coerce numeric env values to strings in workflow step configuration

github-actions · 2026-04-08T16:16:03Z

Subscribed to pull request

File Patterns	Mentions
*/	@douglowder

Generated by CodeMention

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-08T16:18:57Z

packages/steps/src/__tests__/BuildConfig-test.ts

+        test('env number coerced to string', () => {
+          const buildConfig = {
+            build: {
+              steps: [
+                {
+                  run: {
+                    command: 'echo 123',
+                    env: {
+                      HOMEBREW_NO_AUTO_UPDATE: 1,
+                    },
+                  },
+                },
+              ],
+            },
+          };
+
+          const config = validateConfig(BuildConfigSchema, buildConfig);
+          assert(isBuildStepCommandRun(config.build.steps[0]));
+          expect(config.build.steps[0].run.env).toEqual({ HOMEBREW_NO_AUTO_UPDATE: '1' });
+        });
+        test('numeric-like string env value is not coerced', () => {
+          const buildConfig = {
+            build: {
+              steps: [
+                {
+                  run: {
+                    command: 'echo 123',
+                    env: {
+                      PORT: '001',
+                      SCALE: '1e3',
+                    },
+                  },
+                },
+              ],
+            },
+          };
+
+          const config = validateConfig(BuildConfigSchema, buildConfig);
+          assert(isBuildStepCommandRun(config.build.steps[0]));
+          expect(config.build.steps[0].run.env).toEqual({ PORT: '001', SCALE: '1e3' });


PR description says there are two new test cases verifying numeric env coercion for both run steps and function calls, but this test file only adds coverage for run.env (and a separate case for numeric-like strings). Either add a test that asserts numeric env values are coerced for function-call steps (e.g. say_hi.env) or update the PR description/test plan to match what’s actually covered.

github-actions · 2026-04-08T16:22:20Z

✅ Thank you for adding the changelog entry!

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

codecov · 2026-04-08T16:27:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.28%. Comparing base (c6d4fae) to head (d0f25b7).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3583      +/-   ##
==========================================
+ Coverage   54.27%   54.28%   +0.01%     
==========================================
  Files         820      820              
  Lines       35055    35056       +1     
  Branches     7260     7260              
==========================================
+ Hits        19024    19025       +1     
  Misses      15944    15944              
  Partials       87       87

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

szdziedzic requested a review from Copilot April 8, 2026 16:06

Copilot started reviewing on behalf of szdziedzic April 8, 2026 16:07 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

szdziedzic force-pushed the 04-08-_eng-14822_steps_coerce_env_in_steps_to_string branch from 77ec396 to 543b32c Compare April 8, 2026 16:10

szdziedzic force-pushed the 04-08-_eng-14822_steps_coerce_env_in_steps_to_string branch 2 times, most recently from 55c0633 to 1d0ea7c Compare April 8, 2026 16:15

szdziedzic requested a review from Copilot April 8, 2026 16:15

szdziedzic marked this pull request as ready for review April 8, 2026 16:15

szdziedzic requested a review from sjchmiela April 8, 2026 16:16

Copilot AI reviewed Apr 8, 2026

View reviewed changes

[ENG-14822][steps] Coerce env in steps to string

d0f25b7

szdziedzic force-pushed the 04-08-_eng-14822_steps_coerce_env_in_steps_to_string branch from 1d0ea7c to d0f25b7 Compare April 8, 2026 16:22

szdziedzic requested a review from Copilot April 8, 2026 16:22

Copilot started reviewing on behalf of szdziedzic April 8, 2026 16:23 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ENG-14822][steps] Coerce env in steps to string#3583

[ENG-14822][steps] Coerce env in steps to string#3583
szdziedzic wants to merge 1 commit intomainfrom
04-08-_eng-14822_steps_coerce_env_in_steps_to_string

szdziedzic commented Apr 8, 2026 •

edited

Loading

Uh oh!

linear bot commented Apr 8, 2026

Uh oh!

szdziedzic commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

szdziedzic commented Apr 8, 2026

Uh oh!

github-actions bot commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

github-actions bot commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

codecov bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	.try(Joi.number(), Joi.string().allow(''))
	.try(Joi.number().strict(), Joi.string().allow(''))

Conversation

szdziedzic commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

How

Test Plan

Uh oh!

linear bot commented Apr 8, 2026

Uh oh!

szdziedzic commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

szdziedzic commented Apr 8, 2026

Uh oh!

github-actions bot commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

codecov bot commented Apr 8, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

szdziedzic commented Apr 8, 2026 •

edited

Loading