How to avoid VERCEL_OIDC_TOKEN from "busting" our turbo tasks

Help
1

Summary

Hello! On our CI we pull env vars from Vercel as we use Vercel to manage them. We use the vercel cli for that.
We rarely if ever get cache hits since the “VERCEL_OIDC_TOKEN” change from inside our .env file. Our turbo json is as so:

{
// ..
    "test": {
      "dependsOn": ["test:assets:pull"],
      "passThroughEnv": ["VERCEL_OIDC_TOKEN"]
    },
// ..
}

And still we see cache misses.

We can see why we get cache misses from the --dry-run=json output:

{
  "id": "33Pw2FCX7nN0Zl8yUeo1wu5LsMp",
  "version": "1",
  "turboVersion": "2.4.1",
  "monorepo": true,
[...]
    "rootKey": "I can’t see ya, but I know you’re here",
    "files": {
      ".env": "THIS_IS_STABLE",
      "apps/web/.env": "THIS_CHANGES_BETWEEN_RUNS"
    },
[...]
}

If we run --dry-run=json twice and compare the outputs, the apps/web/.env is always changing. If we compare the .env files between runs, the value that changes is always VERCEL_OIDC_TOKEN.

Any idea here?

in short we do:

cd apps/web
vercel link --scope team --yes
vercel env pull .env --yes
turbo run test # we get a cache miss. next time we run our CI, another cache miss..