From 8a97666b713d14a83d657bb92c6b6f2ff7cd98d8 Mon Sep 17 00:00:00 2001
From: Nathan Houle <nathan@nathanhoule.com>
Date: Tue, 17 Feb 2026 17:01:40 -0800
Subject: [PATCH] fix: require is_secret attribute on deploy environment
 variables

This attribute is always required by the API and so omitting it, even
when false or defaulting to false, results in an API error.

I've also cleaned up an unused type from the porcelain package.
---
 go/models/deploy_environment_variable.go | 16 +++++++++++++++-
 go/porcelain/deploy.go                   | 12 +++---------
 swagger.yml                              |  1 +
 3 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/go/models/deploy_environment_variable.go b/go/models/deploy_environment_variable.go
index 37f4fc7f..21a4bf9f 100644
--- a/go/models/deploy_environment_variable.go
+++ b/go/models/deploy_environment_variable.go
@@ -21,7 +21,8 @@ import (
 type DeployEnvironmentVariable struct {
 
 	// is secret
-	IsSecret bool `json:"is_secret,omitempty"`
+	// Required: true
+	IsSecret *bool `json:"is_secret"`
 
 	// key
 	// Required: true
@@ -40,6 +41,10 @@ type DeployEnvironmentVariable struct {
 func (m *DeployEnvironmentVariable) Validate(formats strfmt.Registry) error {
 	var res []error
 
+	if err := m.validateIsSecret(formats); err != nil {
+		res = append(res, err)
+	}
+
 	if err := m.validateKey(formats); err != nil {
 		res = append(res, err)
 	}
@@ -58,6 +63,15 @@ func (m *DeployEnvironmentVariable) Validate(formats strfmt.Registry) error {
 	return nil
 }
 
+func (m *DeployEnvironmentVariable) validateIsSecret(formats strfmt.Registry) error {
+
+	if err := validate.Required("is_secret", "body", m.IsSecret); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (m *DeployEnvironmentVariable) validateKey(formats strfmt.Registry) error {
 
 	if err := validate.Required("key", "body", m.Key); err != nil {
diff --git a/go/porcelain/deploy.go b/go/porcelain/deploy.go
index 368ddb34..8196f39f 100644
--- a/go/porcelain/deploy.go
+++ b/go/porcelain/deploy.go
@@ -43,9 +43,9 @@ const (
 
 	lfsVersionString = "version https://git-lfs.github.com/spec/v1"
 
-	edgeFunctionsInternalPath  = ".netlify/internal/edge-functions/"
-	edgeRedirectsInternalPath  = ".netlify/deploy-config/"
-	dbMigrationsInternalPath   = ".netlify/internal/db/migrations/"
+	edgeFunctionsInternalPath = ".netlify/internal/edge-functions/"
+	edgeRedirectsInternalPath = ".netlify/deploy-config/"
+	dbMigrationsInternalPath  = ".netlify/internal/db/migrations/"
 )
 
 var installDirs = []string{"node_modules/", "bower_components/"}
@@ -77,12 +77,6 @@ type DeployWarner interface {
 	OnWalkWarning(path, msg string)
 }
 
-type DeployEnvironmentVariable struct {
-	Key      string
-	Value    string
-	IsSecret bool
-}
-
 // DeployOptions holds the option for creating a new deploy
 type DeployOptions struct {
 	SiteID            string
diff --git a/swagger.yml b/swagger.yml
index 7012d81a..252539d2 100644
--- a/swagger.yml
+++ b/swagger.yml
@@ -4152,6 +4152,7 @@ definitions:
       - key
       - value
       - scopes
+      - is_secret
     properties:
       key:
         type: string