From ff842f97e2776315d5724938b4f219fb6020463a Mon Sep 17 00:00:00 2001
From: Claude Fable 5 <fable-5@waidele.info>
Date: Thu, 30 Jul 2026 17:16:00 +0200
Subject: [PATCH] =?UTF-8?q?#198:=20CI=20fence=20=E2=80=94=20no=20tracked?=
 =?UTF-8?q?=20.env=20or=20secret=20material,=20example=20is=20authoritativ?=
 =?UTF-8?q?e?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Verification result: only deploy/compose/.env.example was ever tracked
(full-history check), zero hits for obvious secret patterns across all
added lines in history — recorded on issue #231 (residual-risk list).

The new CI step in the checks job fails if any .env other than
.env.example is tracked or a tracked file matches an obvious secret
pattern (private key blocks, AWS/GitHub/GitLab/Slack token shapes).
.env.example already documents every variable the compose files
reference (verified: comm of compose ${VAR} refs vs example keys is
empty). README states the example as the authoritative reference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ
---
 .gitea/workflows/ci.yml          | 20 ++++++++++++++++++++
 docs/self-hosting/README.md      |  4 ++++
 docs/vs-nfd/20-massnahmenplan.md |  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7131f63..a881ee5 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -38,6 +38,26 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      # Fails if a real .env (anything but .env.example) is ever tracked, or
+      # if a tracked file matches an obvious secret pattern (issue #198).
+      # .env.example is the authoritative reference; real values never enter
+      # the repository (docs/self-hosting/README.md).
+      - name: No tracked .env files or secret material
+        run: |
+          set -euo pipefail
+          bad_env=$(git ls-files | grep -E '(^|/)\.env(\.[^/]*)?$' | grep -v '\.env\.example$' || true)
+          if [ -n "$bad_env" ]; then
+            echo "tracked .env file(s) — only .env.example may be tracked:"
+            echo "$bad_env"
+            exit 1
+          fi
+          secrets=$(git grep -nIE -e '-----BEGIN [A-Z ]*PRIVATE KEY-----|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20}|xox[baprs]-[0-9A-Za-z-]{10}' -- . || true)
+          if [ -n "$secrets" ]; then
+            echo "tracked file matches a secret pattern:"
+            echo "$secrets"
+            exit 1
+          fi
+
       - name: Set up pnpm
         uses: pnpm/action-setup@v4
 
diff --git a/docs/self-hosting/README.md b/docs/self-hosting/README.md
index f90c929..48a353f 100644
--- a/docs/self-hosting/README.md
+++ b/docs/self-hosting/README.md
@@ -40,6 +40,10 @@ work, that is a bug (issue #88).
      from it.
    - Every other variable is documented inline in `.env.example` with its
      default and effect; nothing outside that file configures the stack.
+   - `.env.example` is the authoritative reference: real values live only
+     in your local `.env` and never enter the repository — a CI check
+     fails if any `.env` other than `.env.example` is ever tracked
+     (issue #198).
 
 3. Start:
 
diff --git a/docs/vs-nfd/20-massnahmenplan.md b/docs/vs-nfd/20-massnahmenplan.md
index db3dccc..49a9c6e 100644
--- a/docs/vs-nfd/20-massnahmenplan.md
+++ b/docs/vs-nfd/20-massnahmenplan.md
@@ -106,7 +106,7 @@ chain`_
 - [x] **Retention-Job für `audit_log`** · 1 AT · #196
 - [x] **Security-Header** (helmet), CORS explizit restriktiv · 1 AT · #197
 - [ ] **SBOM in CI** (CycloneDX/syft) + Lizenzreport als Artefakt · 1–2 AT · #202
-- [ ] `deploy/compose/.env` prüfen, Beispieldatei statt Realdatei · 0,5 AT · #198
+- [x] `deploy/compose/.env` prüfen, Beispieldatei statt Realdatei · 0,5 AT · #198
 - [ ] **Attachment-Integritätshashes** · +2–3 AT · #199 ⟵ neu aus Roadmap
       SHA-256-Spalte, Berechnung beim Upload, Prüfung beim Download,
       Backfill-Migration. Nebennutzen: Orphan-Sweep, Dedup, Backup-Verifikation.