Repository navigation
Conversation
## Summary Writes the env and secret file naming rule the maintainer decided in #3503 into `CODESTYLE.md` "Script and Utility File Names", and moves the `secrets.stems` check onto it. - **The rule.** It reaches every env and secret file a repository names, tracked or host-side. `_` joins fields, each field keeps its own valid form so a host name keeps its hyphens, and the name carries no dot but its extension. It also states the variable-name conversion, the Docker and POSIX limits, and the tool-fixed `.env*` exemption. - **The check.** `secret_stem_findings` reads the new grammar rather than a snake_case stem. It now also reads tracked `.env` files outside `.secrets/` whose name opens on no dot. A trailing `.example` is set aside, case-folded for the scope test. - **The catalog.** `AUDIT.md` "runtime-secrets", `spec/project-types.json`, `spec/checks.json`, and `GOVERNANCE.md` "Repo-Scoped Secrets" state the same rule, and say what stays judged by hand: a hyphen joining words, the consumer limits, and host-side names. Closes #3503 ## Verification - Full suite, `uv run --no-project --with-requirements tests/requirements.txt python -m unittest discover -s tests`: 2965 tests, OK (skipped=7). - `spec/audit.py --selftest` passes, and `spec/validate.py` passes. - The pre-commit gates (ruff, mypy, prose, eol) pass on every commit. - A local strict pass ran and was recorded at every pushed head. Each round's findings were fixed or are listed below. ## Maintainer answer folded in The first local pass asked how a fully qualified host name is written in a field. The maintainer answered on #3503. A host field is a short name, the host's first DNS label or a logical role name such as `vps-staging`, in DNS label form, never a fully qualified name. `CODESTYLE.md`, `AUDIT.md`, and the catalog assert now say so. ## Declined local review findings - **Route a hyphenated word such as `db-root-password` to a judge-by-hand DRIFT.** The audit has no advisory level, only DEFECT, DRIFT, ERROR, and LETTER, and this check has no exemption path. So every validly host-named file such as `app_web-01_prod.env` would carry a DRIFT it could never clear. `AUDIT.md` states the hyphen judgment instead. - **Build the field pattern from `HYPHENATED_FILE_STEM`.** The field allows a run of hyphens, as an IDN label `xn--bcher-kva` does, and the script-stem pattern does not. - **Add an exemption path for a tool-fixed, non-dotted `*.env` outside `.secrets/`.** `gh search code --owner ptr727 --extension env` finds only `.secrets/example.env` in one repository, which passes. The input is trusted maintainer content, and the tool-fixed env names are dotfiles, which the check skips, per `GOVERNANCE.md` "Trust Boundaries and Hardening Effort". ## Dropped findings - `AUDIT.md:72`, `style`. The opt-in `sentence-length` check flags two sentences on this line that this change does not touch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Clarify the .env* exemption in CODESTYLE.md so it does not contradict the .secrets/ naming requirements.
No open issues 🎉
What changed in this PR
Promotes the environment and secret file naming rule to main, aligning audit logic, specifications, documentation, and tests around the shared naming convention.
Changes:
- Extends validation to tracked
.envfiles outside.secrets/. - Documents naming grammar, host fields, extensions, templates, and exemptions.
- Updates audit catalogs and expands test coverage for valid and invalid filenames.
| File | Summary |
|---|---|
tests/test_audit.py |
Updates integration expectations for the new naming rule. |
tests/test_audit_helpers.py |
Adds coverage for valid, invalid, templated, and exempt filenames. |
spec/project-types.json |
Aligns the runtime-secrets catalog assertion. |
spec/checks.json |
Updates the secrets.stems check description and source specification. |
spec/audit.py |
Implements the expanded filename grammar and tracked .env scope. |
GOVERNANCE.md |
Aligns repo-scoped secret naming guidance with the shared convention. |
CODESTYLE.md |
Defines the canonical environment and secret filename rule; clarify that the .env* exemption applies outside repo-scoped .secrets/. |
AUDIT.md |
Documents the mechanical and manual runtime-secret naming checks. |
Review effort: Lite
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3507 +/- ##
==========================================
+ Coverage 81.10% 81.11% +0.01%
==========================================
Files 26 26
Lines 8907 8914 +7
==========================================
+ Hits 7224 7231 +7
Misses 1683 1683
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
## Summary Answers the headline of Copilot's round on promotion #3507, "Clarify the `.env*` exemption in `CODESTYLE.md` so it does not contradict the `.secrets/` naming requirements." `CODESTYLE.md` "Script and Utility File Names" exempts an env file a tool reads by a fixed name, such as `.env`. `GOVERNANCE.md` "Repo-Scoped Secrets" rules out a bare `.env` as the shared env file in `.secrets/`. The two never applied to the same file, but the exemption did not say so. It now says an env or secret file in a `.secrets/` directory is never tool-fixed, since the repository configures the path it is read by. The next sentence names the exemption rather than a pronoun that would have attached to that file. The `secrets.stems` check already behaves this way: it flags a bare `.env` inside `.secrets/` and skips a dot-leading name outside one. Refs #3503 ## Verification - The prose gate passes, `sentence-length` included. - Two local strict passes ran. The first raised two wording findings, both fixed in `2d6cdbee`. The second found nothing and is recorded at the head. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
Merge Gate item 2 at head d65fb3b: Copilot's round on this head errored (the quota body), so coverage reads none. The maintainer authorized the merge on constituent coverage. Copilot's first round on this promotion (head 9890e4a) tabled exactly the 8 files #3506 changed, and its headline was answered by #3508, which carries its own Copilot table on its merged head 2d6cdbe, approval recommended. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the pull requests merged into develop since release 2.0.1195.
CODESTYLE.md"Script and Utility File Names" now states one naming convention for every env and secret file a repository names, tracked or host-side. Fields are joined by_. A host field is a short name in DNS label form, never a fully qualified name. The name carries no dot but its extension. Thesecrets.stemscheck reads that grammar and now also reaches tracked.envfiles outside.secrets/.AUDIT.md,GOVERNANCE.md"Repo-Scoped Secrets", and the spec catalog follow.CODESTYLE.md's tool-fixed env exemption now says an env or secret file in a.secrets/directory is never tool-fixed, so it no longer reads as contradictingGOVERNANCE.md's rule against a bare.envthere.Closes #3503
Constituent coverage
Each change this promotion carries had coverage on its own pull request into develop:
5753c6dadevelop, and a Copilot round on an earlier head whose two findings were fixed and resolved2d6cdbeedevelop, and a Copilot table on the merged head naming exactly its 1 changed file, approval recommended, no findings🤖 Generated with Claude Code