#198: CI fence -- no tracked .env or secret material, example is authoritative #253

fable-5 · 2026-07-30T21:42:13+02:00

fable-5 commented

2026-07-30 21:42:13 +02:00

For #198 (issue closed manually after green pipeline, per repo convention).Verification: only deploy/compose/.env.example was ever tracked (full-history check); zero hits for obvious secret patterns across all lines ever added -- recorded as a comment on #231 (residual-risk list). comm of compose ${VAR} references vs .env.example keys is empty, i.e. the example already documents every variable (incl. #188/#190/#192 additions; #191 is an instance setting, not env).Changes: new early CI step in the checks job failing on any tracked .env other than .env.example or on obvious secret patterns (private-key blocks, AWS/GitHub/GitLab/Slack token shapes; tested positive and negative locally); self-hosting README states .env.example as the authoritative reference; plan checkbox ticked.

fable-5 added 1 commit 2026-07-30 21:42:13 +02:00

#198 : CI fence — no tracked .env or secret material, example is authoritative

CI / Lint, typecheck, test (pull_request) Successful in 5m27s

Details

CI / Build container images (pull_request) Successful in 1m16s

Details

CI / Auth e2e pack (pull_request) Successful in 7m49s

Details

CI / Import/export fidelity gate (pull_request) Successful in 57s

Details

CD / Build and push images (push) Successful in 19s

Details

CD / Deploy to Test (push) Successful in 28s

Details

CD / Smoke tests against Test (push) Successful in 1m32s

Details

CD / Promote to Int (push) Successful in 12s

Details

CI / Lint, typecheck, test (push) Successful in 5m14s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 7m41s

Details

CI / Import/export fidelity gate (push) Failing after 10s

Details

ff842f97e2

Verification result: only deploy/compose/.env.example was ever tracked
(full-history check), zero hits for obvious secret patterns across all
added lines in history — recorded on issue #231 (residual-risk list).

The new CI step in the checks job fails if any .env other than
.env.example is tracked or a tracked file matches an obvious secret
pattern (private key blocks, AWS/GitHub/GitLab/Slack token shapes).
.env.example already documents every variable the compose files
reference (verified: comm of compose ${VAR} refs vs example keys is
empty). README states the example as the authoritative reference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 merged commit ff842f97e2 into main

2026-07-30 21:59:44 +02:00

fable-5 referenced this pull request

2026-07-30 22:00:15 +02:00

[VS-NfD] Verify that no real `.env` is shipped and document the example as authoritative #198

Sign in to join this conversation.

No reviewers