Skip to content

ci(risk-paths): exclude .env.example/template/sample from blocked glob #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
topcoder1 wants to merge 1 commit into
base: main
Choose a base branch
from
+15 −1
Open

ci(risk-paths): exclude .env.example/template/sample from blocked glob #74

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion .github/risk-paths.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,21 @@ blocked:
- 'Dockerfile*'
- 'docker-compose*.yaml'
- 'docker-compose*.yml'
- '**/.env*'
# Only the actual secrets-bearing .env variants are blocked. Documentation
# templates (.env.example, .env.sample, .env.template, .env.dist) are NOT
# secrets — they ship literal-string placeholders to teach readers which
# env vars exist. Treating them as `blocked` was a false-positive that
# bounced wxa-graph PR #154 in 2026-05-23.
- '**/.env'
- '**/.env.local'
- '**/.env.development'
- '**/.env.development.local'
- '**/.env.production'
- '**/.env.production.local'
- '**/.env.staging'
- '**/.env.staging.local'
- '**/.env.test'
- '**/.env.test.local'
- '**/secrets*'
Comment on lines +30 to 39
Copy link
Copy Markdown

@claude claude Bot May 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The explicit enumeration misses several common secrets-bearing variants that the old **/.env* glob caught. Real projects frequently use names like .env.prod, .env.dev, .env.ci, .env.qa, .env.uat, .env.preview, and .env.stg — files that are semantically secrets-bearing but spell out shorthand environment names rather than the full production/development/staging strings.

After this change, a PR that adds .env.prod with real credentials would classify as standard and could auto-merge, whereas before it would have been blocked.

Two options:

  1. Add the common shorthands to the list (**/.env.prod, **/.env.dev, **/.env.ci, **/.env.qa, **/.env.uat, **/.env.stg, **/.env.preview).
  2. Invert the logic in classify.mjs: block **/.env* by default, then in the classifier explicitly unclassify known-safe suffixes (.example, .sample, .template, .dist) back to standard. This is more robust but requires a code change to the script rather than just YAML.

Option 1 is the simpler fix for now, though it will always be an incomplete enumeration as new shorthand names appear. Option 2 closes the class of bypass permanently.

- '.github/workflows/**'
- '.github/risk-paths.yml'
Expand Down
Loading