[ptr727]

Summary

Promotes the carried secret readers to main.

• #561 carries the hub's lib/sh to lib/fleet/sh. deploy/make-release.sh checks its env file with require_secret and reads DEPLOY_ROOT, DEPLOY_SSH_HOST, and SITE_BASE_URL with read_env_value, replacing the set -a sourcing. The docs describe the new reading, and each copy step says to make the file mode 600.
• #563 and #564 fix the wording that Copilot's rounds on this pull request flagged. .secrets/example.env and OPERATIONS.md now name the values the script reads from its file, rather than crediting the shell's sourcing.
• #560 is develop's copy of the hub workflow bump that #559 already landed on main.

Verification

• A local staging release of develop at 6671b6c built and installed through the new reader against the real staging env file, and checks/check-live-urls.sh with EXPECT_RELEASE passed every URL.
• Read the Release Env File Through the Carried Secret Readers #561's own checks, its four recorded local strict review passes, and its Copilot round are on that pull request.

Issues

Closes #553

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0c08e5b6-157b-438d-85b1-eefec097a25f

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.98%. Comparing base (b885743) to head (b09f9e4).
⚠️ Report is 162 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #562   +/-   ##
=======================================
  Coverage   53.98%   53.98%           
=======================================
  Files          12       12           
  Lines        3412     3412           
=======================================
  Hits         1842     1842           
  Misses       1570     1570           

Flag	Coverage Δ
python-3.13	53.98% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟡 Changes recommended

Two documentation inconsistencies remain: the example environment claim overstates which values the script reads, and the operations runbook incorrectly describes DEPLOY_ROOT as sourced rather than read.

2 open issues

• Limit override claim to values the script actually reads · New
• Describe DEPLOY_ROOT as read, not sourced · New

What changed in this PR

This pull request promotes the carried secret-reader integration and reusable workflow updates to main. The release script now validates and selectively reads environment files instead of sourcing them directly.

Changes:

• Adds the carried secret validation and environment-value reader library.
• Updates release, deployment, environment, and secret-file documentation.
• Updates deploy/make-release.sh to read only required values.
• Pins reusable workflows to ProjectTemplate 2.0.1192.
• Includes the carried shell library in local lint and formatting tasks.
• Records three documentation nits: two in OPERATIONS.md and one in .secrets/example.env.

File	Description
README.md	Documents required permissions for local environment files.
OPERATIONS.md	Updates release procedures and environment-reading guidance. Findings: two [P2] nits (3 votes and 1 vote) clarify file-reading and sourcing terminology.
lib/​fleet/​sh/​secrets.sh	Adds the carried secret validation and environment-value readers.
ENVIRONMENT.md	Describes validation, precedence, and selective environment-file reading.
deploy/​README.md	Documents environment-file setup, permissions, and selection.
deploy/​make-release.sh	Validates the environment file and reads selected values through the carried readers.
.vscode/​tasks.json	Includes the carried shell library in shell lint and format tasks.
.secrets/​README.md	Documents required private permissions for environment files.
.secrets/​example.env	Updates environment-file usage and permission notes. Finding: one [P2] nit (2 votes) limits the override claim to the values read by the release script.
.github/​workflows/​test-pull-request.yml	Pins the reusable validation workflow to 2.0.1192.
.github/​workflows/​publish-release.yml	Pins release planning, validation, and build workflows to 2.0.1192.
.github/​workflows/​merge-bot-pull-request.yml	Pins the merge-bot workflow to 2.0.1192.
.github/​workflows/​deploy-site.yml	Pins validation and deployment workflows to 2.0.1192.
.editorconfig	Preserves four-space indentation for the carried shell tree.

_{Review effort: Lite}

[Copilot]

🔵 Needs a closer look

OPERATIONS.md still inaccurately describes ENV_FILE as sourced, conflicting with the script’s current read-based behavior and leaving the runbook inconsistent.

No open issues 🎉

2 resolved since last review

• Describe DEPLOY_ROOT as read, not sourced
• Limit override claim to values the script actually reads

_{Review effort: Lite}

[ptr727]

Headline on the 7063a41 round (OPERATIONS.md still describing ENV_FILE as sourced): Fixed in b09f9e4 (#564). OPERATIONS.md:70 said "ENV_FILE is set as well as sourced", meaning that the shell sources the file and the command also names it in ENV_FILE. It now says "The file is both sourced in the shell and named in ENV_FILE". A sweep of OPERATIONS.md, ENVIRONMENT.md, deploy/README.md, README.md, and .secrets/README.md found no other sentence saying ENV_FILE or the script sources the file.

[Copilot]

🟢 Approval recommended

No active review issues are identified for the documented secret-reader, release-script, and workflow updates.

No open issues 🎉

_{Review effort: Lite}