fix(astro): dynamically import actions (#13510)

* feat: update test

* feat: dynamic import

* chore: changeset

* Update .changeset/clever-tigers-dig.md

12 files changed, 96 insertions, 51 deletions

diff --git a/.changeset/clever-tigers-dig.md b/.changeset/clever-tigers-dig.md
new file mode 100644
index 000000000..62429099a
--- /dev/null
+++ b/.changeset/clever-tigers-dig.md
@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes a case where `astro:env` secrets used in actions would not be available
diff --git a/packages/astro/src/actions/noop-actions.ts b/packages/astro/src/actions/noop-actions.ts
new file mode 100644
index 000000000..0a2de4d68
--- /dev/null
+++ b/packages/astro/src/actions/noop-actions.ts
@@ -0,0 +1,5 @@
+import type { SSRActions } from '../core/app/types.js';
+
+export const NOOP_ACTIONS_MOD: SSRActions = {
+	server: {},
+};
diff --git a/packages/astro/src/core/app/types.ts b/packages/astro/src/core/app/types.ts
index d07163329..9339f2384 100644
--- a/packages/astro/src/core/app/types.ts
+++ b/packages/astro/src/core/app/types.ts
@@ -77,7 +77,7 @@ export type SSRManifest = {
 	key: Promise<CryptoKey>;
 	i18n: SSRManifestI18n | undefined;
 	middleware?: () => Promise<AstroMiddlewareInstance> | AstroMiddlewareInstance;
-	actions?: SSRActions;
+	actions?: () => Promise<SSRActions> | SSRActions;
 	checkOrigin: boolean;
 	sessionConfig?: ResolvedSessionConfig<any>;
 	cacheDir: string | URL;
diff --git a/packages/astro/src/core/base-pipeline.ts b/packages/astro/src/core/base-pipeline.ts
index 99006910b..d2cf1f053 100644
--- a/packages/astro/src/core/base-pipeline.ts
+++ b/packages/astro/src/core/base-pipeline.ts
@@ -19,6 +19,7 @@ import { NOOP_MIDDLEWARE_FN } from './middleware/noop-middleware.js';
 import { sequence } from './middleware/sequence.js';
 import { RouteCache } from './render/route-cache.js';
 import { createDefaultRoutes } from './routing/default.js';
+import { NOOP_ACTIONS_MOD } from '../actions/noop-actions.js';
 
 /**
  * The `Pipeline` represents the static parts of rendering that do not change between requests.
@@ -131,9 +132,9 @@ export abstract class Pipeline {
 		if (this.resolvedActions) {
 			return this.resolvedActions;
 		} else if (this.actions) {
-			return this.actions;
+			return await this.actions();
 		}
-		return { server: {} };
+		return NOOP_ACTIONS_MOD;
 	}
 
 	async getAction(path: string): Promise<ActionClient<unknown, ActionAccept, ZodType>> {
diff --git a/packages/astro/src/core/build/generate.ts b/packages/astro/src/core/build/generate.ts
index 0627f378f..c91dc48de 100644
--- a/packages/astro/src/core/build/generate.ts
+++ b/packages/astro/src/core/build/generate.ts
@@ -49,6 +49,7 @@ import type {
 	StylesheetAsset,
 } from './types.js';
 import { getTimeStat, shouldAppendForwardSlash } from './util.js';
+import { NOOP_ACTIONS_MOD } from '../../actions/noop-actions.js';
 
 export async function generatePages(options: StaticBuildOptions, internals: BuildInternals) {
 	const generatePagesTimer = performance.now();
@@ -66,7 +67,7 @@ export async function generatePages(options: StaticBuildOptions, internals: Buil
 
 		const actions: SSRActions = internals.astroActionsEntryPoint
 			? await import(internals.astroActionsEntryPoint.toString()).then((mod) => mod)
-			: { server: {} };
+			: NOOP_ACTIONS_MOD;
 		manifest = createBuildManifest(
 			options.settings,
 			internals,
@@ -651,7 +652,7 @@ function createBuildManifest(
 				onRequest: middleware,
 			};
 		},
-		actions,
+		actions: () => actions,
 		checkOrigin:
 			(settings.config.security?.checkOrigin && settings.buildOutput === 'server') ?? false,
 		key,
diff --git a/packages/astro/src/core/build/plugins/plugin-ssr.ts b/packages/astro/src/core/build/plugins/plugin-ssr.ts
index 56e1458c8..7dac35194 100644
--- a/packages/astro/src/core/build/plugins/plugin-ssr.ts
+++ b/packages/astro/src/core/build/plugins/plugin-ssr.ts
@@ -168,7 +168,6 @@ function generateSSRCode(adapter: AstroAdapter, middlewareId: string) {
 
 	const imports = [
 		`import { renderers } from '${RENDERERS_MODULE_ID}';`,
-		`import * as actions from '${ASTRO_ACTIONS_INTERNAL_MODULE_ID}';`,
 		`import * as serverEntrypointModule from '${ADAPTER_VIRTUAL_MODULE_ID}';`,
 		`import { manifest as defaultManifest } from '${SSR_MANIFEST_VIRTUAL_MODULE_ID}';`,
 		`import { serverIslandMap } from '${VIRTUAL_ISLAND_MAP_ID}';`,
@@ -180,7 +179,7 @@ function generateSSRCode(adapter: AstroAdapter, middlewareId: string) {
 		`    pageMap,`,
 		`    serverIslandMap,`,
 		`    renderers,`,
-		`    actions,`,
+		`    actions: () => import("${ASTRO_ACTIONS_INTERNAL_MODULE_ID}"),`,
 		`    middleware: ${edgeMiddleware ? 'undefined' : `() => import("${middlewareId}")`}`,
 		`});`,
 		`const _args = ${adapter.args ? JSON.stringify(adapter.args, null, 4) : 'undefined'};`,
diff --git a/packages/integrations/cloudflare/test/astro-env.test.js b/packages/integrations/cloudflare/test/astro-env.test.js
index a20d20dd9..af1a366e0 100644
--- a/packages/integrations/cloudflare/test/astro-env.test.js
+++ b/packages/integrations/cloudflare/test/astro-env.test.js
@@ -62,4 +62,11 @@ describe('astro:env', () => {
 		const $ = cheerio.load(html);
 		assert.equal($('#secret').text().includes('123456789'), true);
 	});
+
+	it('action secret', async () => {
+		const res = await fetch('http://127.0.0.1:8788/test');
+		const html = await res.text();
+		const $ = cheerio.load(html);
+		assert.equal($('#secret').text().includes('123456789'), true);
+	});
 });
diff --git a/packages/integrations/cloudflare/test/fixtures/astro-env/package.json b/packages/integrations/cloudflare/test/fixtures/astro-env/package.json
index cca11825d..d3b910161 100644
--- a/packages/integrations/cloudflare/test/fixtures/astro-env/package.json
+++ b/packages/integrations/cloudflare/test/fixtures/astro-env/package.json
@@ -7,6 +7,6 @@
     "astro": "workspace:*"
   },
   "devDependencies": {
-    "wrangler": "^3.112.0"
+    "wrangler": "^4.4.1"
   }
 }
diff --git a/packages/integrations/cloudflare/test/fixtures/astro-env/src/actions.ts b/packages/integrations/cloudflare/test/fixtures/astro-env/src/actions.ts
new file mode 100644
index 000000000..79d675a37
--- /dev/null
+++ b/packages/integrations/cloudflare/test/fixtures/astro-env/src/actions.ts
@@ -0,0 +1,12 @@
+import { defineAction } from "astro:actions";
+import { API_SECRET } from "astro:env/server";
+
+export const server = {
+  getSecret: defineAction({
+    handler(_input, _context) {
+      return {
+        secret: API_SECRET,
+      };
+    },
+  }),
+};
\ No newline at end of file
diff --git a/packages/integrations/cloudflare/test/fixtures/astro-env/src/middleware.ts b/packages/integrations/cloudflare/test/fixtures/astro-env/src/middleware.ts
new file mode 100644
index 000000000..e0985dc8f
--- /dev/null
+++ b/packages/integrations/cloudflare/test/fixtures/astro-env/src/middleware.ts
@@ -0,0 +1,9 @@
+import { defineMiddleware } from 'astro/middleware'
+import { API_SECRET } from 'astro:env/server'
+
+const secret = API_SECRET
+
+export const onRequest = defineMiddleware((_ctx, next) => {
+    console.log({ secret })
+    return next()
+})
\ No newline at end of file
diff --git a/packages/integrations/cloudflare/test/fixtures/astro-env/src/pages/test.astro b/packages/integrations/cloudflare/test/fixtures/astro-env/src/pages/test.astro
new file mode 100644
index 000000000..74e4223a7
--- /dev/null
+++ b/packages/integrations/cloudflare/test/fixtures/astro-env/src/pages/test.astro
@@ -0,0 +1,6 @@
+---
+import { actions } from "astro:actions";
+const { data } = await Astro.callAction(actions.getSecret, {});
+---
+
+<span id="secret">{data?.secret}</span>
\ No newline at end of file
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index df5638fff..199030db5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4569,7 +4569,7 @@ importers:
         version: 0.30.17
       miniflare:
         specifier: ^4.20250317.0
-        version: 4.20250319.0
+        version: 4.20250321.0
       tinyglobby:
         specifier: ^0.2.12
         version: 0.2.12
@@ -4578,7 +4578,7 @@ importers:
         version: 6.2.3(@types/node@22.13.1)(jiti@2.4.2)(lightningcss@1.29.2)(sass@1.86.0)(yaml@2.5.1)
       wrangler:
         specifier: ^4.2.0
-        version: 4.3.0(@cloudflare/workers-types@4.20250320.0)
+        version: 4.4.1(@cloudflare/workers-types@4.20250320.0)
     devDependencies:
       astro:
         specifier: workspace:*
@@ -4622,8 +4622,8 @@ importers:
         version: link:../../../../../astro
     devDependencies:
       wrangler:
-        specifier: ^3.112.0
-        version: 3.112.0(@cloudflare/workers-types@4.20250320.0)
+        specifier: ^4.4.1
+        version: 4.4.1(@cloudflare/workers-types@4.20250320.0)
 
   packages/integrations/cloudflare/test/fixtures/compile-image-service:
     dependencies:
@@ -6662,11 +6662,11 @@ packages:
     resolution: {integrity: sha512-+tv3z+SPp+gqTIcImN9o0hqE9xyfQjI1XD9pL6NuKjua9B1y7mNYv0S9cP+QEbA4ppVgGZEmKOvHX5G5Ei1CVA==}
     engines: {node: '>=18.0.0'}
 
-  '@cloudflare/unenv-preset@2.2.0':
-    resolution: {integrity: sha512-U5/TQBjJN/HQ1JA4mzt5sTbvdT9aoucHYGbokY2JWwDkYbgoaTygYBshZpXHUo8lDppsAGdUf3pGlOc6U09HAg==}
+  '@cloudflare/unenv-preset@2.3.0':
+    resolution: {integrity: sha512-AaKYnbFpHaVDZGh3Hjy3oLYd12+LZw9aupAOudYJ+tjekahxcIqlSAr0zK9kPOdtgn10tzaqH7QJFUWcLE+k7g==}
     peerDependencies:
       unenv: 2.0.0-rc.15
-      workerd: ^1.20250310.0
+      workerd: ^1.20250311.0
     peerDependenciesMeta:
       workerd:
         optional: true
@@ -6677,8 +6677,8 @@ packages:
     cpu: [x64]
     os: [darwin]
 
-  '@cloudflare/workerd-darwin-64@1.20250319.0':
-    resolution: {integrity: sha512-8B08kYAp1rEgXRe+YV3uCAGYa65KS8V/pajmgh5U4yULLmHryd4OPo8wf3RYl4uk5ZNbtUKR1GUNLkIraTL6Rw==}
+  '@cloudflare/workerd-darwin-64@1.20250321.0':
+    resolution: {integrity: sha512-y273GfLaNCxkL8hTfo0c8FZKkOPdq+CPZAKJXPWB+YpS1JCOULu6lNTptpD7ZtF14dTYPkn5Weug31TTlviJmw==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [darwin]
@@ -6689,8 +6689,8 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
-  '@cloudflare/workerd-darwin-arm64@1.20250319.0':
-    resolution: {integrity: sha512-UW1c15oFYRPxwt4qEQufA/XlK5AnbVJFs7PwXo2suLXhxAdTZUKk0Mg1DgDTN65wmqQimRt4ayLVbfxFpzt0bA==}
+  '@cloudflare/workerd-darwin-arm64@1.20250321.0':
+    resolution: {integrity: sha512-qvf7/gkkQq7fAsoMlntJSimN/WfwQqxi2oL0aWZMGodTvs/yRHO2I4oE0eOihVdK1BXyBHJXNxEvNDBjF0+Yuw==}
     engines: {node: '>=16'}
     cpu: [arm64]
     os: [darwin]
@@ -6701,8 +6701,8 @@ packages:
     cpu: [x64]
     os: [linux]
 
-  '@cloudflare/workerd-linux-64@1.20250319.0':
-    resolution: {integrity: sha512-oYrTq/FP74IxaEwqHZep8sPoy5btrb8x9ubt6aYy+A1s8IHqma3bYzDmRJ8AMDl9d5+ASFqkAqB/Cj8HN1agPA==}
+  '@cloudflare/workerd-linux-64@1.20250321.0':
+    resolution: {integrity: sha512-AEp3xjWFrNPO/h0StCOgOb0bWCcNThnkESpy91Wf4mfUF2p7tOCdp37Nk/1QIRqSxnfv4Hgxyi7gcWud9cJuMw==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [linux]
@@ -6713,8 +6713,8 @@ packages:
     cpu: [arm64]
     os: [linux]
 
-  '@cloudflare/workerd-linux-arm64@1.20250319.0':
-    resolution: {integrity: sha512-n9Qy+iA6SQSL3dRLXlkTQEHP65/i6Mk4UOFh67BOlrFJlov+/u77pyGG4koPLcuts0SnGxA0eDNlua6CN/GGAg==}
+  '@cloudflare/workerd-linux-arm64@1.20250321.0':
+    resolution: {integrity: sha512-wRWyMIoPIS1UBXCisW0FYTgGsfZD4AVS0hXA5nuLc0c21CvzZpmmTjqEWMcwPFenwy/MNL61NautVOC4qJqQ3Q==}
     engines: {node: '>=16'}
     cpu: [arm64]
     os: [linux]
@@ -6725,8 +6725,8 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@cloudflare/workerd-windows-64@1.20250319.0':
-    resolution: {integrity: sha512-MUYzPZiz3wbLtHjfc0RdO0tETTDJF9OcRPNzw8RpWba98Z1uhMX2hQ5gNQNgQJ+Y5TDMlcKHZVIJU/5E7/qcZw==}
+  '@cloudflare/workerd-windows-64@1.20250321.0':
+    resolution: {integrity: sha512-8vYP3QYO0zo2faUDfWl88jjfUvz7Si9GS3mUYaTh/TR9LcAUtsO7muLxPamqEyoxNFtbQgy08R4rTid94KRi3w==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [win32]
@@ -10609,8 +10609,8 @@ packages:
     engines: {node: '>=16.13'}
     hasBin: true
 
-  miniflare@4.20250319.0:
-    resolution: {integrity: sha512-xBBsl1TOkelBcSXikhvu5bQMZucXy8lXNGUgix4Fi0Fuz3d9flMpyIM7XVI5Br1BPqQ3hwwLASMOBBahAJYWag==}
+  miniflare@4.20250321.0:
+    resolution: {integrity: sha512-os+NJA7Eqi00BJHdVhzIa+3PMotnCtZg3hiUIRYcsZF5W7He8SK2EkV8csAb+npZq3jZ4SNpDebO01swM5dcWw==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -12605,8 +12605,8 @@ packages:
     engines: {node: '>=16'}
     hasBin: true
 
-  workerd@1.20250319.0:
-    resolution: {integrity: sha512-/+JfU0Iq+L2DWpJeBCvQIY88OkxoEV5IPbTpa+FFkBTW3eAyE7pV+DpvcvXfG94DFrA3D4z0EE9ZNwVKO5w42A==}
+  workerd@1.20250321.0:
+    resolution: {integrity: sha512-vyuz9pdJ+7o1lC79vQ2UVRLXPARa2Lq94PbTfqEcYQeSxeR9X+YqhNq2yysv8Zs5vpokmexLCtMniPp9u+2LVQ==}
     engines: {node: '>=16'}
     hasBin: true
 
@@ -12620,12 +12620,12 @@ packages:
       '@cloudflare/workers-types':
         optional: true
 
-  wrangler@4.3.0:
-    resolution: {integrity: sha512-eGSj/Og4cxMF2jwstPswayU2aj9fN4FSX7rF3p+Pqe/EEVrCrs/38YsBXePbAjTs+4F8K/VvWtXYRzZ1xtZRuA==}
+  wrangler@4.4.1:
+    resolution: {integrity: sha512-EFwr7hiVeAmPOuOGQ7HFfeaLKLxEXQMJ86kyn6RFB8pGjMEUtvZMsVa9cPubKkKgNi3WcDEFeFLalclGyq+tGA==}
     engines: {node: '>=18.0.0'}
     hasBin: true
     peerDependencies:
-      '@cloudflare/workers-types': ^4.20250319.0
+      '@cloudflare/workers-types': ^4.20250321.0
     peerDependenciesMeta:
       '@cloudflare/workers-types':
         optional: true
@@ -13302,40 +13302,40 @@ snapshots:
     dependencies:
       mime: 3.0.0
 
-  '@cloudflare/unenv-preset@2.2.0(unenv@2.0.0-rc.15)(workerd@1.20250319.0)':
+  '@cloudflare/unenv-preset@2.3.0(unenv@2.0.0-rc.15)(workerd@1.20250321.0)':
     dependencies:
       unenv: 2.0.0-rc.15
     optionalDependencies:
-      workerd: 1.20250319.0
+      workerd: 1.20250321.0
 
   '@cloudflare/workerd-darwin-64@1.20250214.0':
     optional: true
 
-  '@cloudflare/workerd-darwin-64@1.20250319.0':
+  '@cloudflare/workerd-darwin-64@1.20250321.0':
     optional: true
 
   '@cloudflare/workerd-darwin-arm64@1.20250214.0':
     optional: true
 
-  '@cloudflare/workerd-darwin-arm64@1.20250319.0':
+  '@cloudflare/workerd-darwin-arm64@1.20250321.0':
     optional: true
 
   '@cloudflare/workerd-linux-64@1.20250214.0':
     optional: true
 
-  '@cloudflare/workerd-linux-64@1.20250319.0':
+  '@cloudflare/workerd-linux-64@1.20250321.0':
     optional: true
 
   '@cloudflare/workerd-linux-arm64@1.20250214.0':
     optional: true
 
-  '@cloudflare/workerd-linux-arm64@1.20250319.0':
+  '@cloudflare/workerd-linux-arm64@1.20250321.0':
     optional: true
 
   '@cloudflare/workerd-windows-64@1.20250214.0':
     optional: true
 
-  '@cloudflare/workerd-windows-64@1.20250319.0':
+  '@cloudflare/workerd-windows-64@1.20250321.0':
     optional: true
 
   '@cloudflare/workers-types@4.20250320.0': {}
@@ -17446,7 +17446,7 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  miniflare@4.20250319.0:
+  miniflare@4.20250321.0:
     dependencies:
       '@cspotcode/source-map-support': 0.8.1
       acorn: 8.14.0
@@ -17455,7 +17455,7 @@ snapshots:
       glob-to-regexp: 0.4.1
       stoppable: 1.1.0
       undici: 5.28.5
-      workerd: 1.20250319.0
+      workerd: 1.20250321.0
       ws: 8.18.0
       youch: 3.2.3
       zod: 3.22.3
@@ -19636,13 +19636,13 @@ snapshots:
       '@cloudflare/workerd-linux-arm64': 1.20250214.0
       '@cloudflare/workerd-windows-64': 1.20250214.0
 
-  workerd@1.20250319.0:
+  workerd@1.20250321.0:
     optionalDependencies:
-      '@cloudflare/workerd-darwin-64': 1.20250319.0
-      '@cloudflare/workerd-darwin-arm64': 1.20250319.0
-      '@cloudflare/workerd-linux-64': 1.20250319.0
-      '@cloudflare/workerd-linux-arm64': 1.20250319.0
-      '@cloudflare/workerd-windows-64': 1.20250319.0
+      '@cloudflare/workerd-darwin-64': 1.20250321.0
+      '@cloudflare/workerd-darwin-arm64': 1.20250321.0
+      '@cloudflare/workerd-linux-64': 1.20250321.0
+      '@cloudflare/workerd-linux-arm64': 1.20250321.0
+      '@cloudflare/workerd-windows-64': 1.20250321.0
 
   wrangler@3.112.0(@cloudflare/workers-types@4.20250320.0):
     dependencies:
@@ -19663,16 +19663,16 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  wrangler@4.3.0(@cloudflare/workers-types@4.20250320.0):
+  wrangler@4.4.1(@cloudflare/workers-types@4.20250320.0):
     dependencies:
       '@cloudflare/kv-asset-handler': 0.4.0
-      '@cloudflare/unenv-preset': 2.2.0(unenv@2.0.0-rc.15)(workerd@1.20250319.0)
+      '@cloudflare/unenv-preset': 2.3.0(unenv@2.0.0-rc.15)(workerd@1.20250321.0)
       blake3-wasm: 2.1.5
       esbuild: 0.24.2
-      miniflare: 4.20250319.0
+      miniflare: 4.20250321.0
       path-to-regexp: 6.3.0
       unenv: 2.0.0-rc.15
-      workerd: 1.20250319.0
+      workerd: 1.20250321.0
     optionalDependencies:
       '@cloudflare/workers-types': 4.20250320.0
       fsevents: 2.3.3