fix(cli): export OIDC-minted token to build env so prerender getToken sees it (review)

The single-step GitHub Actions workflow drops the curl/jq step that wrote
`VOID_TOKEN` to `$GITHUB_ENV`. `void deploy` now mints the deploy token
in-process, but assigned it only to a local variable. The downstream build
and prerender re-read credentials via `getToken()` (which reads
`process.env.VOID_TOKEN` first) — both in-process (`collectPrerenderPaths`)
and inside the spawned `vite build` child (`plugin-prerender`'s closeBundle,
which inherits `process.env` via `buildEnv`). A local variable reaches
neither, so in CI the prerender injected no `__VOID_TOKEN`/`__VOID_PROJECT_ID`
and rendered against local/empty bindings (AI, remote D1/KV/R2 break) —
a regression from the removed scaffold step.

Export the minted token to `process.env.VOID_TOKEN` right after masking,
inside the `!token` OIDC branch so an explicit `VOID_TOKEN` is never
overwritten. This restores exact parity with the removed `$GITHUB_ENV` write.
The token is the same deploy-scoped (`aud: deploy`, short-TTL) token the old
workflow exposed to the build, so visibility is parity, not new exposure.
The `command === 'serve'` gate on `__VOID_TOKEN` worker-var injection is
untouched, so this does not leak the token into `dist/ssr/wrangler.json`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Brooooooklyn

packages/void/src/cli/deploy.ts

@@ -404,6 +404,18 @@ async function runDeployInner(
         cliLog.info('github_oidc_exchange_start', { slug });
         token = await exchangeGithubOidcForDeployToken(getApiUrl(root), slug);
         maskGithubActionsSecret(token);
+        // Export the minted token so the downstream build/prerender can reach
+        // it. Both prerender paths re-read credentials via `getToken()`, which
+        // reads `process.env.VOID_TOKEN` first: the in-process path
+        // (`collectPrerenderPaths` below) and the spawned `vite build` child
+        // (`plugin-prerender`'s closeBundle, which inherits `process.env` via
+        // `buildEnv`). A local variable can't reach either, so without this the
+        // prerender injects no `__VOID_TOKEN`/`__VOID_PROJECT_ID` and renders
+        // against local/empty bindings (AI, remote D1/KV/R2 break). This
+        // restores parity with the removed scaffold step that wrote
+        // `VOID_TOKEN` to `$GITHUB_ENV`. Guarded by the enclosing `!token`
+        // branch, so an explicit `VOID_TOKEN` is never overwritten.
+        process.env.VOID_TOKEN = token;
         cliLog.info('github_oidc_exchange_success', { slug });
       }
       if (!token) {

packages/void/test/unit/deploy-auth.test.ts

@@ -20,6 +20,7 @@ const mockExchangeOidc = vi.fn();
 const mockMaskSecret = vi.fn();
 
 const originalIsTTY = process.stdin.isTTY;
+let savedVoidToken: string | undefined;
 
 vi.mock('@clack/prompts', () => ({
   intro: vi.fn(),
@@ -92,6 +93,11 @@ beforeEach(() => {
   });
   mockPromptForLoginToken.mockResolvedValue('fresh-token');
   Object.defineProperty(process.stdin, 'isTTY', { value: false, configurable: true });
+
+  // Isolate process.env.VOID_TOKEN across tests: the OIDC branch now exports
+  // the minted token there, so start each test clean and restore afterwards.
+  savedVoidToken = process.env.VOID_TOKEN;
+  delete process.env.VOID_TOKEN;
 });
 
 describe('runDeploy auth failures', () => {
@@ -150,6 +156,35 @@ describe('runDeploy GitHub Actions OIDC exchange', () => {
     expect(mockMaskSecret).not.toHaveBeenCalled();
   });
 
+  it('exports the minted token to process.env.VOID_TOKEN so the build/prerender getToken sees it', async () => {
+    mockGetToken.mockReturnValue(null);
+    mockIsOidcAvailable.mockReturnValue(true);
+    mockExchangeOidc.mockResolvedValue('minted-token');
+
+    // The deploy throws later (listProjects rejects), but the OIDC branch runs
+    // first. The minted token must land in process.env.VOID_TOKEN — the
+    // downstream `vite build` child (which inherits process.env) and the
+    // in-process prerender both re-read it via getToken(), which reads
+    // process.env.VOID_TOKEN first. A local variable can't reach either.
+    await expect(runDeploy(process.cwd(), { projectSlug: 'my-app' })).rejects.toThrow();
+
+    expect(process.env.VOID_TOKEN).toBe('minted-token');
+  });
+
+  it('does NOT overwrite an explicit VOID_TOKEN in process.env (no mint)', async () => {
+    // getToken returns a token (explicit VOID_TOKEN / keychain / file), so the
+    // OIDC branch is skipped and the existing process.env.VOID_TOKEN is left
+    // untouched — no re-mint, no clobber.
+    mockGetToken.mockReturnValue('explicit-token');
+    mockIsOidcAvailable.mockReturnValue(true);
+    process.env.VOID_TOKEN = 'explicit-env-token';
+
+    await expect(runDeploy(process.cwd(), { projectSlug: 'my-app' })).rejects.toThrow();
+
+    expect(mockExchangeOidc).not.toHaveBeenCalled();
+    expect(process.env.VOID_TOKEN).toBe('explicit-env-token');
+  });
+
   it('errors when in Actions but the project is unknown', async () => {
     mockGetToken.mockReturnValue(null);
     mockIsOidcAvailable.mockReturnValue(true);
@@ -297,4 +332,9 @@ describe('buildEnv', () => {
 
 afterEach(() => {
   Object.defineProperty(process.stdin, 'isTTY', { value: originalIsTTY, configurable: true });
+  if (savedVoidToken === undefined) {
+    delete process.env.VOID_TOKEN;
+  } else {
+    process.env.VOID_TOKEN = savedVoidToken;
+  }
 });