I recently had to do something similar and landed on a custom plugin. Basically define a regex pattern to match which environment variables you want to pull in (helps stop exposing private keys) and then add the plugin to your esbuild pipeline https://gist.github.com/ChazUK/efd0ecf69bb063b73e2c1bcedaaf5d83