payload build requires runtime secrets because it loads the full config (Payload 3 & 4) #18497

Describe the Bug

payload build imports payload.config.ts in full before it runs the framework build. It does this through runtime.getConfig(): first to load the CLI commands, then for generateImportMap and generateTypes.

A config that validates its environment when it is imported therefore breaks the build in CI. Examples are throwing on a missing PAYLOAD_SECRET or DATABASE_URL, or on any value the app requires. In CI, runtime secrets are deliberately absent. The framework build that follows (vite build on TanStack Start) never evaluates the config, so only the generate step needs it.

Today there are two workarounds, and neither is good:

• Placeholder values in the build environment. Every required variable needs a fake value, only so the config can load.
• A config that detects it is being built. Build-specific branches end up in production code.

Payload 3 had the same problem with next build, and the docs describe a workaround for it: https://payloadcms.com/docs/production/building-without-a-db-connection

Expected behavior

The build-time steps (import map, types) can run without runtime configuration. Some options:

• A documented, supported way to build without runtime values, for example:
  • the CLI loads the config in a mode where secret and db aren't required, or
  • buildConfig takes them lazily, so they are only read when Payload initialises.
• A flag such as payload build --skip-generate that runs only the framework build, so the generated files can come from a separate step that has the secrets, or be committed.

Link to the code that reproduces this issue

https://github.com/Llois41/payload-build-requires-secret

Reproduction Steps

1. In payload.config.ts, throw when process.env.PAYLOAD_SECRET is unset.
2. Run payload build with no PAYLOAD_SECRET in the environment.
3. The build fails during config loading, before vite build starts.

Which area(s) are affected?

area: core

Environment Info

### Versions

- `payload` 4.0.0-canary.37
- `@payloadcms/tanstack-start` 4.0.0-canary.37
- `@payloadcms/db-postgres` 4.0.0-canary.37
- Node 26