feat(cli): auto-detect environment variables as deploy secrets

[jorgemoya]

Jira: TRAC-360

What/Why?

The deploy command now auto-detects required BigCommerce environment variables from process.env when they aren't explicitly passed via --secret:

• BIGCOMMERCE_STORE_HASH
• BIGCOMMERCE_CHANNEL_ID
• BIGCOMMERCE_STOREFRONT_TOKEN
• BIGCOMMERCE_API_HOST
• BIGCOMMERCE_GRAPHQL_API_DOMAIN

This pairs with the --env-path flag — instead of passing each variable individually as --secret KEY=VALUE, you can point to an env file and the deploy command will pick them up automatically:

catalyst deploy --env-path .env.local

Missing required vars (STORE_HASH, CHANNEL_ID, STOREFRONT_TOKEN) produce a warning. Optional vars (API_HOST, GRAPHQL_API_DOMAIN, AUTH_SECRET) are silently skipped. Explicit --secret flags always take precedence.

Rollout/Rollback

Standard rollback — revert the commit. No migrations or feature flags involved.

Testing

Unit tests added covering:

• Auto-detection from process.env
• User-provided --secret takes precedence (no duplicates)
• Warnings for missing required env vars
• Silent skip for missing optional env vars

pnpm --filter @bigcommerce/catalyst exec vitest run src/cli/commands/deploy.spec.ts

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
catalyst	Ready	Preview, Comment	Apr 3, 2026 2:03pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 08b3de6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Bundle Size Report

Comparing against baseline from a8dd99e (2026-04-03).

No bundle size changes detected.

[github-actions]

Unlighthouse Performance Comparison — Vercel

Comparing PR preview deployment Unlighthouse scores vs production Unlighthouse scores.

Summary Score

Aggregate score across all categories as reported by Unlighthouse.

	Prod Desktop	Prod Mobile	Preview Desktop	Preview Mobile
Score	92	94	91	94

Category Scores

Category	Prod Desktop	Prod Mobile	Preview Desktop	Preview Mobile
Performance	78	96	76	84
Accessibility	95	98	95	91
Best Practices	100	100	95	100
SEO	88	100	100	100

Core Web Vitals

Metric	Prod Desktop	Prod Mobile	Preview Desktop	Preview Mobile
LCP	3.4 s	2.7 s	3.5 s	4.5 s
CLS	0	0.039	0	0.001
FCP	1.2 s	1.2 s	1.2 s	1.1 s
TBT	0 ms	20 ms	10 ms	0 ms
Max Potential FID	40 ms	80 ms	60 ms	40 ms
Time to Interactive	3.4 s	3.4 s	4.0 s	4.6 s

Full Unlighthouse report →