fix: remove remaining dotenvx references causing ENOENT in CI

Author: jdalton

.env.precommit

@@ -1,5 +1,5 @@
 # Socket CLI Pre-commit Test Environment
-# This file is loaded by dotenvx during pre-commit hooks.
+# This file is loaded during pre-commit hooks.
 
 # Disable API token requirement for unit tests.
 SOCKET_CLI_NO_API_TOKEN=1

packages/cli/package.json

@@ -40,20 +40,20 @@
     "clean:node-smol": "del-cli 'build/node-smol'",
     "clean:node_modules": "del-cli '**/node_modules'",
     "fix": "oxfmt --write . && oxlint --fix -c ../../.oxlintrc.json",
-    "lint-staged": "dotenvx -q run -f .env.local -- lint-staged",
-    "precommit": "dotenvx -q run -f .env.local -- lint-staged",
+    "lint-staged": "lint-staged",
+    "precommit": "lint-staged",
     "prepare": "husky",
-    "bs": "dotenvx -q run -f .env.local -- pnpm run build && pnpm exec socket --",
-    "s": "dotenvx -q run -f .env.local -- pnpm exec socket --",
+    "bs": "pnpm run build && pnpm exec socket --",
+    "s": "pnpm exec socket --",
     "dev": "node --experimental-strip-types src/cli-dispatch.mts",
     "dev:npm": "cross-env SOCKET_CLI_MODE=npm node --experimental-strip-types src/cli-dispatch.mts",
     "dev:npx": "cross-env SOCKET_CLI_MODE=npx node --experimental-strip-types src/cli-dispatch.mts",
-    "e2e-tests": "dotenvx -q run -f .env.test -- vitest run --config vitest.e2e.config.mts",
+    "e2e-tests": "vitest run --config vitest.e2e.config.mts",
     "e2e:js": "node scripts/e2e.mts --js",
     "e2e:sea": "node scripts/e2e.mts --sea",
     "e2e:all": "node scripts/e2e.mts --all",
     "test": "run-s check test:*",
-    "test:prepare": "dotenvx -q run -f .env.test -- pnpm build && del-cli 'test/**/node_modules'",
+    "test:prepare": "pnpm build && del-cli 'test/**/node_modules'",
     "test:unit": "node --import=./scripts/load.mts scripts/test-wrapper.mts",
     "test:unit:update": "node --import=./scripts/load.mts scripts/test-wrapper.mts --update",
     "test:unit:coverage": "node --import=./scripts/load.mts scripts/test-wrapper.mts --coverage",

packages/cli/scripts/e2e.mts

@@ -14,6 +14,7 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 
 import { EnvironmentVariables } from './environment-variables.mts'
+import { loadEnvFile } from './utils/load-env.mts'
 
 const logger = getDefaultLogger()
 
@@ -122,30 +123,25 @@ async function runVitest(binaryType) {
   // This is required for tests to load external tool versions (coana, cdxgen, synp, etc).
   const externalToolVersions = EnvironmentVariables.getTestVariables()
 
-  // Use dotenvx to load test environment.
-  const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
-  const dotenvxPath = path.join(NODE_MODULES_BIN_PATH, dotenvxCmd)
+  // Load .env.e2e configuration (falls back gracefully if missing).
+  const e2eEnv = loadEnvFile(path.join(ROOT_DIR, '.env.e2e'))
 
   // Resolve vitest path.
   const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
   const vitestPath = path.join(NODE_MODULES_BIN_PATH, vitestCmd)
 
   const result = await spawn(
-    dotenvxPath,
+    vitestPath,
     [
-      '-q',
-      'run',
-      '-f',
-      '.env.e2e',
-      '--',
-      vitestPath,
       'run',
       'test/e2e/binary-test-suite.e2e.test.mts',
       '--config',
       'vitest.e2e.config.mts',
     ],
     {
+      cwd: ROOT_DIR,
       env: {
+        ...e2eEnv,
         ...process.env,
         // Automatically enable tests when explicitly running e2e.mts.
         RUN_E2E_TESTS: '1',

packages/cli/scripts/integration.mts

@@ -14,6 +14,7 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 
 import { EnvironmentVariables } from './environment-variables.mts'
+import { loadEnvFile } from './utils/load-env.mts'
 
 const logger = getDefaultLogger()
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -80,9 +81,8 @@ async function runVitest(binaryType) {
     return
   }
 
-  // Use dotenvx to load test environment.
-  const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
-  const dotenvxPath = path.join(NODE_MODULES_BIN_PATH, dotenvxCmd)
+  // Load .env.test configuration.
+  const testEnv = loadEnvFile(path.join(ROOT_DIR, '.env.test'))
 
   // Resolve vitest path.
   const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
@@ -92,14 +92,8 @@ async function runVitest(binaryType) {
   const externalToolVersions = EnvironmentVariables.getTestVariables()
 
   const result = await spawn(
-    dotenvxPath,
+    vitestPath,
     [
-      '-q',
-      'run',
-      '-f',
-      '.env.test',
-      '--',
-      vitestPath,
       'run',
       'test/integration/binary/',
       '--config',
@@ -108,6 +102,7 @@ async function runVitest(binaryType) {
     {
       cwd: ROOT_DIR,
       env: {
+        ...testEnv,
         ...process.env,
         // Automatically enable tests when explicitly running integration.mts.
         RUN_INTEGRATION_TESTS: '1',

packages/cli/scripts/test-wrapper.mts

@@ -5,7 +5,7 @@
  * - Memory optimization for RegExp-heavy tests
  * - Cross-platform compatibility (Windows/Unix)
  * - Build validation before running tests
- * - Environment variable loading from .env.test
+ * - Environment variable loading from .env.test (via loadEnvFile)
  * - Inlined variable injection from bundle-tools.json
  */
 
@@ -20,6 +20,7 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 
 import { EnvironmentVariables } from './environment-variables.mts'
+import { loadEnvFile } from './utils/load-env.mts'
 
 const logger = getDefaultLogger()
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -110,9 +111,8 @@ async function main() {
       ...externalToolVersions,
     }
 
-    // Use dotenvx to load .env.test configuration.
-    const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
-    const dotenvxPath = path.join(rootNodeModulesBinPath, dotenvxCmd)
+    // Load .env.test configuration.
+    const testEnv = loadEnvFile(path.join(rootPath, '.env.test'))
 
     // Handle Windows vs Unix for vitest executable.
     const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
@@ -133,28 +133,22 @@ async function main() {
       }
     }
 
-    // Wrap vitest with dotenvx to load .env.test.
-    // Command: dotenvx -q run -f .env.test -- vitest run [args].
-    const dotenvxArgs = [
-      '-q',
-      'run',
-      '-f',
-      '.env.test',
-      '--',
-      vitestPath,
-      'run',
-      ...expandedArgs,
-    ]
-
     // On Windows, .cmd files need shell: true.
     const spawnOptions = {
       cwd: rootPath,
-      env: spawnEnv,
+      env: {
+        ...testEnv,
+        ...spawnEnv,
+      },
       stdio: 'inherit',
       ...(WIN32 ? { shell: true } : {}),
     }
 
-    const result = await spawn(dotenvxPath, dotenvxArgs, spawnOptions)
+    const result = await spawn(
+      vitestPath,
+      ['run', ...expandedArgs],
+      spawnOptions,
+    )
     process.exitCode = result?.code || 0
   } catch (e) {
     logger.error('Failed to spawn test process:', e)

packages/cli/scripts/utils/load-env.mts

@@ -0,0 +1,45 @@
+/** @fileoverview Minimal .env file parser for build and test scripts. */
+
+import { readFileSync } from 'node:fs'
+
+/**
+ * Parse a .env file and return key-value pairs.
+ * Supports comments (#), blank lines, KEY=value, KEY="value", KEY='value'.
+ * Returns an empty object if the file does not exist.
+ */
+export function loadEnvFile(
+  filePath: string,
+): Record<string, string> {
+  const env: Record<string, string> = { __proto__: null } as Record<
+    string,
+    string
+  >
+  let content: string
+  try {
+    content = readFileSync(filePath, 'utf-8')
+  } catch {
+    return env
+  }
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim()
+    // Skip comments and blank lines.
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue
+    }
+    const eqIndex = trimmed.indexOf('=')
+    if (eqIndex === -1) {
+      continue
+    }
+    const key = trimmed.slice(0, eqIndex).trim()
+    let value = trimmed.slice(eqIndex + 1).trim()
+    // Strip surrounding quotes.
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1)
+    }
+    env[key] = value
+  }
+  return env
+}