Address PR review feedback on RUSH_ env trim plugin

Co-authored-by: iclanton <5010588+iclanton@users.noreply.github.com>

Author: Copilot

…nv-vars-experiment_2026-08-28-05-20.json …nv-vars-experiment_2026-08-28-05-20.jsoncommon/changes/@microsoft/rush-lib/trim-rush-env-vars-experiment_2026-08-28-05-20.json renamed to common/changes/@microsoft/rush/trim-rush-env-vars-experiment_2026-08-28-05-20.json common/changes/@microsoft/rush-lib/trim-rush-env-vars-experiment_2026-08-28-05-20.json renamed to common/changes/@microsoft/rush/trim-rush-env-vars-experiment_2026-08-28-05-20.json

@@ -1,7 +1,7 @@
 {
   "changes": [
     {
-      "packageName": "@microsoft/rush-lib",
+      "packageName": "@microsoft/rush",
       "comment": "Add a new `trimRushEnvironmentVariablesForOperations` experiment that, when enabled, omits environment variables whose names begin with `RUSH_` from the environment forwarded to operation processes (e.g. \"build\", \"test\").",
       "type": "minor"
     }

libraries/rush-lib/assets/rush-init/common/config/rush/experiments.json

@@ -141,5 +141,14 @@
    * must implement the optional file-based methods for this to take effect; otherwise it falls back to the
    * buffer-based approach.
    */
-  /*[LINE "HYPOTHETICAL"]*/ "useDirectFileTransfersForBuildCache": true
+  /*[LINE "HYPOTHETICAL"]*/ "useDirectFileTransfersForBuildCache": true,
+
+  /**
+   * By default, Rush forwards its entire process environment (minus a small denylist) to the shell
+   * commands it invokes for operations (e.g. 'build', 'test'). If true, environment variables whose
+   * names begin with `RUSH_` will additionally be omitted from that forwarded environment. This can
+   * help prevent operation scripts from accidentally depending on Rush's own internal environment
+   * variables.
+   */
+  /*[LINE "HYPOTHETICAL"]*/ "trimRushEnvironmentVariablesForOperations": true
 }

libraries/rush-lib/src/api/EnvironmentConfiguration.ts

@@ -255,6 +255,12 @@ export const EnvironmentVariableNames = {
   RUSH_QUIET_MODE: 'RUSH_QUIET_MODE'
 } as const;
 
+/**
+ * Matches the names of environment variables that are reserved for use by Rush itself.
+ * @internal
+ */
+export const RUSH_ENVIRONMENT_VARIABLE_NAME_REGEXP: RegExp = /^RUSH_/i;
+
 let _hasBeenValidated: boolean = false;
 
 let _rushTempFolderOverride: string | undefined;
@@ -496,7 +502,7 @@ export class EnvironmentConfiguration {
 
     const unknownEnvVariables: string[] = [];
     for (const envVarName in process.env) {
-      if (process.env.hasOwnProperty(envVarName) && envVarName.match(/^RUSH_/i)) {
+      if (process.env.hasOwnProperty(envVarName) && envVarName.match(RUSH_ENVIRONMENT_VARIABLE_NAME_REGEXP)) {
         const value: string | undefined = process.env[envVarName];
         // Environment variables are only case-insensitive on Windows
         const normalizedEnvVarName: string = IS_WINDOWS ? envVarName.toUpperCase() : envVarName;

libraries/rush-lib/src/logic/operations/TrimRushEnvironmentVariablesPlugin.ts

@@ -1,16 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { RUSH_ENVIRONMENT_VARIABLE_NAME_REGEXP } from '../../api/EnvironmentConfiguration';
 import type { IPhasedCommandPlugin, PhasedCommandHooks } from '../../pluginFramework/PhasedCommandHooks';
 import type { IEnvironment } from '../../utilities/Utilities';
 
 const PLUGIN_NAME: 'TrimRushEnvironmentVariablesPlugin' = 'TrimRushEnvironmentVariablesPlugin';
 
-/**
- * Prefix used by environment variables that Rush itself defines and consumes.
- */
-const RUSH_ENVIRONMENT_VARIABLE_NAME_PREFIX: 'RUSH_' = 'RUSH_';
-
 /**
  * Phased command plugin that removes environment variables whose names begin with `RUSH_` before
  * they are forwarded to operation processes. Enabled via the `trimRushEnvironmentVariablesForOperations`
@@ -20,13 +16,14 @@ export class TrimRushEnvironmentVariablesPlugin implements IPhasedCommandPlugin
   public apply(hooks: PhasedCommandHooks): void {
     hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph) => {
       graph.hooks.createEnvironmentForOperation.tap(PLUGIN_NAME, (env: IEnvironment) => {
+        const trimmedEnv: IEnvironment = {};
         for (const key of Object.getOwnPropertyNames(env)) {
-          if (key.toUpperCase().startsWith(RUSH_ENVIRONMENT_VARIABLE_NAME_PREFIX)) {
-            delete env[key];
+          if (!RUSH_ENVIRONMENT_VARIABLE_NAME_REGEXP.test(key)) {
+            trimmedEnv[key] = env[key];
           }
         }
 
-        return env;
+        return trimmedEnv;
       });
     });
   }

libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts

@@ -41,7 +41,7 @@ describe(TrimRushEnvironmentVariablesPlugin.name, () => {
     );
 
     const rushConfiguration = RushConfiguration.loadFromConfigurationFile(rushJsonFile);
-    const commandLineJson: ICommandLineJson = JsonFile.load(commandLineJsonFile);
+    const commandLineJson: ICommandLineJson = await JsonFile.loadAsync(commandLineJsonFile);
 
     const commandLineConfiguration = new CommandLineConfiguration(commandLineJson);
     const buildCommand: IPhasedCommandConfig = commandLineConfiguration.commands.get(
@@ -67,16 +67,13 @@ describe(TrimRushEnvironmentVariablesPlugin.name, () => {
 
     const operations: Set<Operation> = await hooks.createOperationsAsync.promise(
       new Set(),
-      fakeCreateOperationsContext as unknown as ICreateOperationsContext
+      fakeCreateOperationsContext as ICreateOperationsContext
     );
 
     // Set up a mock graph and invoke onGraphCreatedAsync so the plugin registers its graph hooks
     const graphHooks: OperationGraphHooks = new OperationGraphHooks();
-    const fakeGraph: IOperationGraph = { hooks: graphHooks } as unknown as IOperationGraph;
-    await hooks.onGraphCreatedAsync.promise(
-      fakeGraph,
-      fakeCreateOperationsContext as unknown as IOperationGraphContext
-    );
+    const fakeGraph: IOperationGraph = { hooks: graphHooks } as IOperationGraph;
+    await hooks.onGraphCreatedAsync.promise(fakeGraph, fakeCreateOperationsContext as IOperationGraphContext);
 
     const operation = Array.from(operations)[0];
     expect(operation).toBeDefined();