Apply One Naming Convention to Every Env and Secret File by ptr727 · Pull Request #3506 · ptr727/ProjectTemplate

ptr727 · 2026-10-26T16:35:54Z

Summary

Writes the env and secret file naming rule the maintainer decided in #3503 into CODESTYLE.md "Script and Utility File Names", and moves the secrets.stems check onto it.

The rule. It reaches every env and secret file a repository names, tracked or host-side. _ joins fields, each field keeps its own valid form so a host name keeps its hyphens, and the name carries no dot but its extension. It also states the variable-name conversion, the Docker and POSIX limits, and the tool-fixed .env* exemption.
The check. secret_stem_findings reads the new grammar rather than a snake_case stem. It now also reads tracked .env files outside .secrets/ whose name opens on no dot. A trailing .example is set aside, case-folded for the scope test.
The catalog. AUDIT.md "runtime-secrets", spec/project-types.json, spec/checks.json, and GOVERNANCE.md "Repo-Scoped Secrets" state the same rule, and say what stays judged by hand: a hyphen joining words, the consumer limits, and host-side names.

Closes #3503

Verification

Full suite, uv run --no-project --with-requirements tests/requirements.txt python -m unittest discover -s tests: 2965 tests, OK (skipped=7).
spec/audit.py --selftest passes, and spec/validate.py passes.
The pre-commit gates (ruff, mypy, prose, eol) pass on every commit.
A local strict pass ran and was recorded at every pushed head. Each round's findings were fixed or are listed below.

Maintainer answer folded in

The first local pass asked how a fully qualified host name is written in a field. The maintainer answered on #3503. A host field is a short name, the host's first DNS label or a logical role name such as vps-staging, in DNS label form, never a fully qualified name. CODESTYLE.md, AUDIT.md, and the catalog assert now say so.

Declined local review findings

Route a hyphenated word such as db-root-password to a judge-by-hand DRIFT. The audit has no advisory level, only DEFECT, DRIFT, ERROR, and LETTER, and this check has no exemption path. So every validly host-named file such as app_web-01_prod.env would carry a DRIFT it could never clear. AUDIT.md states the hyphen judgment instead.
Build the field pattern from HYPHENATED_FILE_STEM. The field allows a run of hyphens, as an IDN label xn--bcher-kva does, and the script-stem pattern does not.
Add an exemption path for a tool-fixed, non-dotted *.env outside .secrets/. gh search code --owner ptr727 --extension env finds only .secrets/example.env in one repository, which passes. The input is trusted maintainer content, and the tool-fixed env names are dotfiles, which the check skips, per GOVERNANCE.md "Trust Boundaries and Hardening Effort".

Dropped findings

AUDIT.md:72, style. The opt-in sentence-length check flags two sentences on this line that this change does not touch.

🤖 Generated with Claude Code

CODESTYLE.md now states the env and secret file rule the maintainer chose in #3503. It reaches every file a repository names, tracked or host-side. Fields are joined by `_` and each keeps its own valid form, so a host name keeps its hyphens. The name carries no dot but its extension. The rule also sets the consumer limits and how a field converts to a variable name. The `secrets.stems` audit check now reads that grammar instead of a snake_case stem. It also reads tracked `.env` files outside `.secrets/` whose name no tool fixes. AUDIT.md and the spec catalog state what the check reads and what stays judged by hand: a hyphen joining words, the consumer limits, and host-side names. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A field may now carry a run of hyphens, as an IDN host label does. The scope test folds case before setting a `.example` suffix aside, so an uppercase suffix is judged rather than skipped. The finding names the GOVERNANCE.md rule a bare `.env` breaks, and the catalog entry names CODESTYLE.md as the rule's home. Long sentences are split, and the judged-by-hand list drops its count. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AUDIT.md and the unreadable-tree message described the check as reading secret-file stems, which it no longer does. The catalog assert's list gains its missing conjunction. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-26T16:36:02Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

Source mode: Auto
Repository: ptr727/ProjectTemplate
Branch: env-secret-file-names
File: .coderabbit.yaml
Commit: 5753c6d
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 2972239f-9be0-48aa-95c1-5bda59e4c49f

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

ptr727 · 2026-10-26T16:36:05Z

A recorded local strict-review pass covers head 22182451ca656e5866782b49205ba7c4d9c58ac9, the content this pull request carries at that commit against develop, and it recorded 2 findings.

Copilot

🟡 Changes recommended

Two unresolved review findings remain regarding host-field dots and sentence-length compliance.

2 open issues

What changed in this PR

This pull request standardizes env and secret file naming across tracked and host-side files, updating the audit tooling, documentation, specifications, and tests.

Changes:

Defines a shared filename grammar with underscore-separated fields and support for hyphenated host fields.
Extends secret_stem_findings to validate applicable .secrets and tracked .env files.
Synchronizes governance, audit metadata, project-type specifications, and test coverage.

File	Description
`tests/test_audit.py`	Updates end-to-end audit expectations.
`tests/test_audit_helpers.py`	Adds coverage for valid and invalid env and secret names.
`spec/project-types.json`	Updates the runtime-secrets naming assertion.
`spec/checks.json`	Points the secrets naming check at `CODESTYLE.md`.
`spec/audit.py`	Implements the new filename grammar and validation scope.
`GOVERNANCE.md`	Aligns repo-scoped secret naming guidance with the new rule.
`CODESTYLE.md`	Defines the fleet-wide env and secret filename convention.
`AUDIT.md`	Documents the runtime-secrets audit scope and manual judgment boundaries.

_{Review effort: Lite}

codecov · 2026-10-26T16:42:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.11%. Comparing base (8321f0e) to head (5753c6d).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #3506      +/-   ##
===========================================
+ Coverage    81.10%   81.11%   +0.01%     
===========================================
  Files           26       26              
  Lines         8907     8914       +7     
===========================================
+ Hits          7224     7231       +7     
  Misses        1683     1683

Flag	Coverage Δ
python-3.13	`81.11% <100.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The maintainer answered the open local-review finding on a fully qualified host name field. A host field is the host's first DNS label or a logical role name, never the fully qualified name, which the check already rejects for its dots. The AUDIT.md list sentence this change lengthened is split. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A role name such as `vps-staging` joins its words with `-`, which the rule otherwise reserves to `_`. The host field now takes the DNS label form whichever kind of name it holds, and the hyphen rule scopes to the other fields. AUDIT.md says where the check misses a host's dots, and the list sentence it lengthened is split under the limit. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AUDIT.md's hyphen sentence now matches CODESTYLE.md, which allows a hyphen to join words only inside a host field. The check's gap is stated by its cause: it cannot tell an extension from a dot-joined last field of an extensionless name. The separator reasoning names a host name label, since a DNS label in general can carry `_`. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ptr727 · 2026-10-26T16:59:39Z

A recorded local strict-review pass covers head c2e13b1fe8f3326cd07d42a323f41d078eae5131, the content this pull request carries at that commit against develop, and it recorded 1 finding.

The assert's drift list read as covering a root `.env.local`, which CODESTYLE.md exempts and the check skips. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ptr727 · 2026-10-26T17:01:29Z

A recorded local strict-review pass covers head 5753c6daeb7c886acf1407a85665af1ff2edd2b1, the content this pull request carries at that commit against develop, and it recorded 0 findings.

## Summary Promotes the pull requests merged into develop since release 2.0.1195. - [#3506](#3506): `CODESTYLE.md` "Script and Utility File Names" now states one naming convention for every env and secret file a repository names, tracked or host-side. Fields are joined by `_`. A host field is a short name in DNS label form, never a fully qualified name. The name carries no dot but its extension. The `secrets.stems` check reads that grammar and now also reaches tracked `.env` files outside `.secrets/`. `AUDIT.md`, `GOVERNANCE.md` "Repo-Scoped Secrets", and the spec catalog follow. - [#3508](#3508): answers this promotion's first Copilot headline. `CODESTYLE.md`'s tool-fixed env exemption now says an env or secret file in a `.secrets/` directory is never tool-fixed, so it no longer reads as contradicting `GOVERNANCE.md`'s rule against a bare `.env` there. Closes #3503 ## Constituent coverage Each change this promotion carries had coverage on its own pull request into develop: | Pull request | Merged head | Coverage | | --- | --- | --- | | [#3506](#3506) | `5753c6da` | attested local pass at the merged head, base `develop`, and a Copilot round on an earlier head whose two findings were fixed and resolved | | [#3508](#3508) | `2d6cdbee` | attested local pass at the merged head, base `develop`, and a Copilot table on the merged head naming exactly its 1 changed file, approval recommended, no findings | 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 and others added 3 commits October 26, 2026 09:14

Copilot AI lite review requested due to automatic review settings October 26, 2026 16:35

Copilot started reviewing on behalf of ptr727 October 26, 2026 16:36

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

Comment thread AUDIT.md Outdated

Comment thread CODESTYLE.md Outdated

ptr727 mentioned this pull request Oct 26, 2026

Apply One Naming Convention to Every Env and Secret File, Host-Side Files Included #3503

Closed

ptr727 and others added 2 commits October 26, 2026 09:53

Name the Tool-Fixed Env Exemption in the Runtime Secrets Assert

5753c6d

The assert's drift list read as covering a root `.env.local`, which CODESTYLE.md exempts and the check skips. Refs #3503 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ptr727 merged commit 9890e4a into develop Oct 26, 2026
13 checks passed

ptr727 deleted the env-secret-file-names branch October 26, 2026 17:40

This was referenced Oct 26, 2026

Promote the Env and Secret File Naming Rule to Main #3507

Merged

Session Handoff [default]: Env and Secret Naming Rule Ready in Promotion #3507, Merge and Release Next #2361

Open

Navigation Menu

Repository navigation

Apply One Naming Convention to Every Env and Secret File - #3506

Apply One Naming Convention to Every Env and Secret File#3506
ptr727 merged 7 commits into
developfrom
env-secret-file-names

ptr727 commented Oct 26, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

ptr727 commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

ptr727 commented Oct 26, 2026

Uh oh!

ptr727 commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ptr727 commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Maintainer answer folded in

Declined local review findings

Dropped findings

Uh oh!

coderabbitai Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ptr727 commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ptr727 commented Oct 26, 2026

Uh oh!

ptr727 commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ptr727 commented Oct 26, 2026 •

edited

Loading

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

codecov Bot commented Oct 26, 2026 •

edited

Loading