[ptr727]

Summary

Work items 2 and 3 of #553. The hub registry now declares host-secrets for this repository, so this change carries the hub's lib/sh and moves deploy/make-release.sh onto it.

• Carried library. lib/fleet/sh/secrets.sh is a byte-for-byte copy of the hub's lib/sh, made with hub main's scripts/carry.py apply. carry.py check reads the copy as current.
• deploy/make-release.sh. The script checks its env file with require_secret, then reads DEPLOY_ROOT, DEPLOY_SSH_HOST, and SITE_BASE_URL with read_env_value. This replaces the [ -f ] check and the set -a sourcing. The default file stays optional when it is absent, since CI reads no file.
• Docs. ENVIRONMENT.md, OPERATIONS.md, deploy/README.md, README.md, .secrets/README.md, and .secrets/example.env now describe the reading the script does. Each copy step says to make the file mode 600.
• .editorconfig. A section scoped to lib/fleet/**.sh keeps the carried copy at the hub's four-space indent, so shfmt -d agrees with it while this repository's own scripts keep tabs.
• .vscode/tasks.json. The shell lint tasks list the carried file, matching CI's file set, so shellcheck follows the source= directive.

Behavior Changes

• Once a file is read, each of the three values is the file's value, or empty where the file leaves it unset. An exported value no longer survives a file that omits the name.
• A default file that is present but not a private, LF-only regular file is refused with a reason, rather than skipped by [ -f ].
• The file's other assignments no longer enter the script's environment.

Verification

• Synthetic env files under a scratch HOME, with hugo off PATH so no build ran: a good default file, a remote file that trips the DEPLOY_SSH_HOST guard, a leftover exported DEPLOY_SSH_HOST replaced by the local file, an absent named file, a CRLF file, a mode 644 file, an absent default with no root, and an absent default with a root argument. Each answered as intended.
• shellcheck over the three tracked scripts is clean with -e SC2317, the local 0.10 false positive. shfmt -d is clean.
• python3 -m unittest discover -s checks/tests passed 203 tests. checks/env_docs_gate.py is clean.
• Hub prose gate with --allow-comments: clean. Without it, the comment-added findings are the carried file and the edited comments, so this pull request carries the comments label.
• Local strict review: four passes, recorded against develop. The first raised 6 findings and the second raised 5, all fixed. The third raised none. The fourth covered the fix for Copilot's missing relative pronoun and raised none.

Dropped findings

• ENVIRONMENT.md:13, OPERATIONS.md:42, OPERATIONS.md:70, OPERATIONS.md:500: opt-in sentence-length flags older sentences that sit on lines this change edited. This change did not write them. Class: style.
• lib/fleet/sh/secrets.sh: opt-in sentence-length flags in the carried copy. The copy is byte-locked to the hub. Class: pre-existing, hub-side.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: feeebfe7-d1ac-4009-a82a-c74226e1050c

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ptr727]

A recorded local strict-review pass covers head 6c72daba484e62001009fb8baae781c84cd2e0f1, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[Copilot]

🟡 Changes recommended

Several active documentation findings remain across the repository, including grammatically incomplete permission-related sentences that should be corrected for clarity.

5 open issues

• Fix incomplete permission-condition sentence · New
• Rewrite fragment as a complete clause · New
• Fix incomplete permission-condition sentence · New
• Fix incomplete permission-condition sentence · New
• Fix incomplete permission-condition sentence · New

What changed in this PR

This pull request moves release environment handling from sourcing the entire file to using the carried secret readers, adds stricter file validation, and updates related documentation and tooling.

Changes:

• Carries lib/fleet/sh/secrets.sh and reads only the required release values.
• Validates private, LF-only environment files and documents the new behavior.
• Updates shell linting, formatting configuration, and environment-file examples.
• Review notes include documentation wording nits and a moderate issue involving env_read_name assignment in the carried helper.

File	Summary
README.md	Documents environment-file permissions; one grammar nit remains.
OPERATIONS.md	Updates release procedures and value-reading behavior; includes grammar and “sourced” terminology nits.
lib/​fleet/​sh/​secrets.sh	Carries the secret readers; has a moderate issue where env_read_name can be overridden by the sourced file.
ENVIRONMENT.md	Documents validation and selective environment-value reads.
deploy/​README.md	Updates environment setup and permissions; one grammar nit remains.
deploy/​make-release.sh	Uses require_secret and read_env_value instead of sourcing the environment file.
.vscode/​tasks.json	Includes the carried library in shell lint tasks.
.secrets/​README.md	Documents secure environment-file setup; one grammar nit remains.
.secrets/​example.env	Updates environment-file usage notes; wording and scope nits remain.
.editorconfig	Applies four-space indentation to the carried shell tree.

_{Review effort: Lite}

[ptr727]

A recorded local strict-review pass covers head f9f230bd02a8890175780e2c65b625ed13611724, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@f4ef45d). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop     #561   +/-   ##
==========================================
  Coverage           ?   53.98%           
==========================================
  Files              ?       12           
  Lines              ?     3412           
  Branches           ?        0           
==========================================
  Hits               ?     1842           
  Misses             ?     1570           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	53.98% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.