(Using my Maintainer's Privilege™️ here to ignore the bug report template) 😄

@juliusmarminge found us a bug and I'm filing on his behalf. In the following two logs, you can see a difference in the printed output of NODE_ENV:

• Cache miss: https://github.com/pingdotgg/uploadthing/actions/runs/12546824655/job/34983263342#step:4:125
• Cache hit: https://github.com/pingdotgg/uploadthing/actions/runs/12545811460/job/34980609091

Notably, the cache hit comes from a run that happened on Vercel, where NODE_ENV is set. This isn't the case in a GitHub Action by default.

The expectation is that this globalPassThroughEnv can be overridden by a passThroughEnv in a Package Configuration.

Here's my reproduction repository. Summary of changes (starting with create-turbo) and how I'm reproducing locally:

1. Put NODE_ENV into globalPassThroughEnv.
2. Add the following snippet.

// ./packages/ui/turbo.json

{
  "extends": ["//"],
  "tasks": {
    "build": {
      "passThroughEnv": ["!NODE_ENV"],
    }
  }
}

3. Add a ./packages/ui/run-this.js file with contents of console.log(process.env.NODE_ENV).
4. Add a script of "build": "node run-this.js" to ./packages/ui/package.json.
5. Put an export NODE_ENV=foo onto your shell.
6. Run turbo build.

You'll get what I believe to be unexpected behavior: NODE_ENV printing foo from run-this.js.

I've tested some of my assumptions by messing with combinations of removing the globalPassThroughEnv, removing the Package Configuration's passThroughEnv, and placing a console.log(process.env.NODE_ENV) into the applications.

I'm thinking the bug here is that we don't merge globalPassThroughEnv with passThroughEnv. I can't find a codepath where this would happen (though I may be simply not be seeing it and there's something else at play that I haven't considered.)