stwaidele/dorfteich

#198: CI fence -- no tracked .env or secret material, example is authoritative #253

Merged

fable-5 merged 1 commits from feat/198-env-verification into main

2026-07-30 21:59:44 +02:00

Author	SHA1	Message	Date
Claude Fable 5	ff842f97e2	#198 : CI fence — no tracked .env or secret material, example is authoritative Some checks failed CI / Lint, typecheck, test (pull_request) Successful in 5m27s Details CI / Build container images (pull_request) Successful in 1m16s Details CI / Auth e2e pack (pull_request) Successful in 7m49s Details CI / Import/export fidelity gate (pull_request) Successful in 57s Details CD / Build and push images (push) Successful in 19s Details CD / Deploy to Test (push) Successful in 28s Details CD / Smoke tests against Test (push) Successful in 1m32s Details CD / Promote to Int (push) Successful in 12s Details CI / Lint, typecheck, test (push) Successful in 5m14s Details CI / Build container images (push) Has been skipped Details CI / Auth e2e pack (push) Successful in 7m41s Details CI / Import/export fidelity gate (push) Failing after 10s Details Verification result: only deploy/compose/.env.example was ever tracked (full-history check), zero hits for obvious secret patterns across all added lines in history — recorded on issue #231 (residual-risk list). The new CI step in the checks job fails if any .env other than .env.example is tracked or a tracked file matches an obvious secret pattern (private key blocks, AWS/GitHub/GitLab/Slack token shapes). .env.example already documents every variable the compose files reference (verified: comm of compose ${VAR} refs vs example keys is empty). README states the example as the authoritative reference. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ	2026-07-30 17:16:00 +02:00