Frank
5976ad0550
rank 7 tail. dankserver/compose.yaml (a parallel inventory whose mounts had diverged from the quadlets) and its .env.example live in dankserver/.AGENTTRASH/20261013-compose-retire/; the retired ik chat template joined scripts/.AGENTTRASH/. No target has a compose file now: - service-map drops the compose selection rule, compose file claim, and check_compose (the check list is schema/units/ownership/config/drift); - deploy-remote's compose fallback is a loud failure, not a WARN-and- nothing for dankserver; - compose_validity.bats goes to tests/.AGENTTRASH (it was sweeping only the trash file); env_consistency sheds its two compose sweeps; - docs_completeness's compose sweep skips .AGENTTRASH so retired services cannot resurrect, and a revived compose stays covered; - Testing Policy drops the Compose validity row.
21 lines
825 B
Bash
21 lines
825 B
Bash
#!/usr/bin/env bats
|
|
# Seam: environment variable consistency and secret hygiene.
|
|
# Every ${VAR} referenced in a Caddyfile must be defined in the matching
|
|
# .env.example. .env.example files must contain only placeholders, and
|
|
# the live gitea database password must never appear in tracked files.
|
|
# (The compose.yaml sweeps retired with the last compose file on 2026-10-13.)
|
|
|
|
load helpers
|
|
|
|
@test ".env.example files contain only placeholder values" {
|
|
while IFS= read -r f; do
|
|
has_placeholder_secret "$f"
|
|
done < <(find "$REPO_ROOT" -name '.env.example' -not -path '*/.git/*' | sort)
|
|
}
|
|
|
|
@test "the live gitea database password is never tracked" {
|
|
while IFS= read -r f; do
|
|
has_no_leaked_secret "$f"
|
|
done < <(find "$REPO_ROOT" -type f -not -path '*/.git/*' -not -path '*/.pi-subagents/*' | sort)
|
|
}
|