#198: CI fence — no tracked .env or secret material, example is authoritative

Verification result: only deploy/compose/.env.example was ever tracked
(full-history check), zero hits for obvious secret patterns across all
added lines in history — recorded on issue #231 (residual-risk list).

The new CI step in the checks job fails if any .env other than
.env.example is tracked or a tracked file matches an obvious secret
pattern (private key blocks, AWS/GitHub/GitLab/Slack token shapes).
.env.example already documents every variable the compose files
reference (verified: comm of compose ${VAR} refs vs example keys is
empty). README states the example as the authoritative reference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

.gitea/workflows/ci.yml

@@ -38,6 +38,26 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      # Fails if a real .env (anything but .env.example) is ever tracked, or
+      # if a tracked file matches an obvious secret pattern (issue #198).
+      # .env.example is the authoritative reference; real values never enter
+      # the repository (docs/self-hosting/README.md).
+      - name: No tracked .env files or secret material
+        run: |
+          set -euo pipefail
+          bad_env=$(git ls-files | grep -E '(^|/)\.env(\.[^/]*)?$' | grep -v '\.env\.example$' || true)
+          if [ -n "$bad_env" ]; then
+            echo "tracked .env file(s) — only .env.example may be tracked:"
+            echo "$bad_env"
+            exit 1
+          fi
+          secrets=$(git grep -nIE -e '-----BEGIN [A-Z ]*PRIVATE KEY-----|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20}|xox[baprs]-[0-9A-Za-z-]{10}' -- . || true)
+          if [ -n "$secrets" ]; then
+            echo "tracked file matches a secret pattern:"
+            echo "$secrets"
+            exit 1
+          fi
+
       - name: Set up pnpm
         uses: pnpm/action-setup@v4
 

docs/self-hosting/README.md

@@ -40,6 +40,10 @@ work, that is a bug (issue #88).
      from it.
    - Every other variable is documented inline in `.env.example` with its
      default and effect; nothing outside that file configures the stack.
+   - `.env.example` is the authoritative reference: real values live only
+     in your local `.env` and never enter the repository — a CI check
+     fails if any `.env` other than `.env.example` is ever tracked
+     (issue #198).
 
 3. Start:
 

docs/vs-nfd/20-massnahmenplan.md

@@ -106,7 +106,7 @@ chain`_
 - [x] **Retention-Job für `audit_log`** · 1 AT · #196
 - [x] **Security-Header** (helmet), CORS explizit restriktiv · 1 AT · #197
 - [ ] **SBOM in CI** (CycloneDX/syft) + Lizenzreport als Artefakt · 1–2 AT · #202
-- [ ] `deploy/compose/.env` prüfen, Beispieldatei statt Realdatei · 0,5 AT · #198
+- [x] `deploy/compose/.env` prüfen, Beispieldatei statt Realdatei · 0,5 AT · #198
 - [ ] **Attachment-Integritätshashes** · +2–3 AT · #199 ⟵ neu aus Roadmap
       SHA-256-Spalte, Berechnung beim Upload, Prüfung beim Download,
       Backfill-Migration. Nebennutzen: Orphan-Sweep, Dedup, Backup-Verifikation.