[vrsarah]

Deploying to Posit Connect Cloud with -E deleted every secret that -E did not name, including secrets added in the Connect Cloud UI. This happened because PATCH /contents/{id} replaces the whole secret set.

Now, when the content already exists, prepare_deploy() also sends the content's other secrets with a None value, which keeps them. Deploys without -E, and creating new content, are unchanged.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-30 15:46 UTC

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
11038	9739	88%	0%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
rsconnect/api.py	89%	🟢
TOTAL	89%	🟢

updated for commit: 4dca9ff by action🐍

[samperman]

secrets is only non-None when env_vars is non-empty, so if secrets is not None: would be enough

[nealrichardson]

This happened because PATCH /contents/{id} replaces the whole secret set

That doesn't sound like PATCH semantics to me, sounds more like a PUT. Are you sure the fix for this isn't on the server side?

[samperman]

This happened because PATCH /contents/{id} replaces the whole secret set

That doesn't sound like PATCH semantics to me, sounds more like a PUT. Are you sure the fix for this isn't on the server side?

It's a PATCH of content, so replacing the array value of secrets seems semantically OK. But I think there's a server-side change that means we don't need to change these clients at all: keep any secret that isn't named in the list, and add an explicit way to delete one. We'd have to coordinate the API change with the UI, which deletes by leaving secrets out today.

It would change PATCH for API callers that delete secrets by leaving them out; their deletes would stop working. We can check our logs to see whether anyone besides the UI and the deploy clients does that.

I approved this PR, but I changed my mind; Neal has convinced me :)

[vrsarah]

Agreed. We're changing the Connect Cloud API so that PATCH keeps any secret that isn't in the list, with a separate endpoint for deleting secrets. That fixes released clients without an upgrade, so I'm closing this PR.