#!/usr/bin/env bats
# Seam: environment variable consistency and secret hygiene.
# Every ${VAR} referenced in a Caddyfile must be defined in the matching
# .env.example. .env.example files must contain only placeholders, and
# the live gitea database password must never appear in tracked files.
# (The compose.yaml sweeps retired with the last compose file on 2026-10-13.)

load helpers

@test ".env.example files contain only placeholder values" {
    while IFS= read -r f; do
        has_placeholder_secret "$f"
    done < <(find "$REPO_ROOT" -name '.env.example' -not -path '*/.git/*' | sort)
}

@test "the live gitea database password is never tracked" {
    while IFS= read -r f; do
        has_no_leaked_secret "$f"
    done < <(find "$REPO_ROOT" -type f -not -path '*/.git/*' -not -path '*/.pi-subagents/*' | sort)
}