Strict mode hides the rest

Tasks see only declared vars; pass tokens through without hashing them.

From turborepo, environment/modes.md.

The token that vanished in CI

Run release, which calls GitHub with a token.

Undeclared tokenBad
    "globalEnv": ["CI"]
    Passed throughGood
      "globalPassThroughEnv": ["GITHUB_TOKEN"]

      A rotating token in the hash

      CI mints a new upload token every run. Run it three times.

      Token in envBad
      0 hits0 runs
      "env": ["SENTRY_AUTH_TOKEN"]
      Token passed throughGood
      0 hits0 runs
      "passThroughEnv": ["SENTRY_AUTH_TOKEN"]
      {
  "envMode": "strict",                       // the default
  "globalEnv": ["CI", "NODE_ENV"],           // hashed, every task
  "globalPassThroughEnv": ["GITHUB_TOKEN"],  // visible, not hashed
  "tasks": {
    "build": {
      "env": ["API_URL"],                    // changes the output: hash it
      "passThroughEnv": ["SENTRY_AUTH_TOKEN"]
    }
  }
}

      Why it matters, pros and cons

      Why it matters

      Strict mode strips every variable you didn't declare, so builds can't depend on a machine by accident. Pass-through vars reach the task without entering the hash.

      Pros

      • Undeclared dependencies fail loudly, not silently.
      • Rotating credentials keep cache hits.
      • Local and CI builds hash the same.

      Cons

      • Output-changing vars in pass-through give stale hits.
      • --env-mode=loose hides the problem, not fixes it.
      • CI vars must be listed one by one.