From dc3bde3d34b4152445a2f799961f591127bb71f3 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Tue, 4 Nov 2025 10:30:10 -0500
Subject: [PATCH] fix: pass whitelist env vars to bun install (#7047)

---
 backend/windmill-worker/src/bun_executor.rs | 1 +
 backend/windmill-worker/src/worker.rs       | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index 4e03043c85..757656b934 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -313,6 +313,7 @@ pub async fn install_bun_lockfile(
         .env_clear()
         .envs(PROXY_ENVS.clone())
         .envs(common_bun_proc_envs)
+        .envs(&*crate::worker::WHITELIST_ENVS)
         .args(args)
         .stdout(Stdio::piped())
         .stderr(Stdio::piped());
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 8cf1e8a7be..db568652e5 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -327,6 +327,12 @@ lazy_static::lazy_static! {
         }
         proxy_env
     };
+    pub static ref WHITELIST_ENVS: HashMap<String, String> = {
+        windmill_common::worker::load_env_vars(
+            windmill_common::worker::load_whitelist_env_vars_from_env(),
+            &HashMap::new(),
+        )
+    };
     pub static ref DENO_PATH: String = std::env::var("DENO_PATH").unwrap_or_else(|_| "/usr/bin/deno".to_string());
     pub static ref BUN_PATH: String = std::env::var("BUN_PATH").unwrap_or_else(|_| "/usr/bin/bun".to_string());
     pub static ref NPM_PATH: String = std::env::var("NPM_PATH").unwrap_or_else(|_| "/usr/bin/npm".to_string());