[E00-S02-T08] Secrets are not embedded in image #389

Merged

kpcto merged 4 commits from feature/175 into main 2026-08-29 10:40:37 +00:00

Conversation 2 Commits 4 Files Changed 6

+908 -7

bot-implementer commented 2026-08-29 01:28:41 +00:00

Member

Copy Link

Copy Source

What changed

Implements [E00-S02-T08] Secrets are not embedded in image (#175) on top of the [E00-S02-T01..T07] Compose baseline (#59): the workspace server application image carries no secrets — statically guaranteed by the committed Dockerfile and .dockerignore, and verified end to end by scanning a built image's layers.

This revision resolves the security review of the previous head (issuecomment-2784, findings 1–4) against the reworked acceptance criteria:

• .dockerignore — exclusions now apply at the root AND at any depth. Every env/credential pattern is **/-prefixed: **/.env, **/.env.*, **/node_modules, **/.npmrc, **/.netrc, **/.credentials, **/.aws, **/.ssh, **/secrets, **/*.pem, **/*.key, **/*.p12, **/*.pfx, **/*.jks, **/id_rsa, **/id_ed25519. Docker's real matcher (moby/patternmatcher) anchors slash-less patterns to the context root, so the previous bare .npmrc/*.key/secrets forms excluded nothing under apps/server/… (finding 1). The redundant secrets/ duplicate is gone (finding 3).
• tests/secrets-not-embedded.test.mjs — the matcher is now Docker-faithful. It is a port of moby/patternmatcher (filepath.Clean + anchored full-path match + parent-directory propagation), not gitignore basename semantics; it asserts the nested example paths (apps/server/.npmrc, config/server.key, apps/server/secrets/…) are excluded, requires the **/-prefixed forms verbatim, and requires no redundant equivalent patterns (finding 2/3). The Docker-gated layer-scan probe now plants marker files at nested paths the Dockerfile's COPY apps/server apps/server would sweep in (apps/server/.env.t08-*, apps/server/secrets/t08-*.pem), so a nested-context leak is observable end to end.
• apps/server/Dockerfile + compose.yaml — the guarantee is stated precisely: credential files are excluded from the build context at the root and at any depth, so a local secret file cannot be embedded even by mistake (finding 3).
• .gitea/workflows/ci.yml — the guarantee is enforced in CI: a new secrets-not-embedded job runs node --test tests/secrets-not-embedded.test.mjs on every PR; the Docker-gated layer-scan probe runs where a Docker daemon is reachable and skips cleanly otherwise (finding 4).
• tests/compose-config.test.mjs — the .dockerignore presence list updated to the **/-prefixed forms.

Runtime credentials (e.g. DATABASE_URL) remain Compose-injected at run time (compose.yaml app.environment), never baked into the image.

Explicitly out of scope per the brief, not touched: multi-arch build targets (E00-S02-T07 — unchanged behavior), app health endpoint (E00-S02-T03).

Criterion → test table

Acceptance criterion	Test (fails without the committed state)
secrets are not embedded in the image	tests/secrets-not-embedded.test.mjs — "the app image embeds no secrets (Dockerfile declares no secret ENV/ARG and copies no secret paths)" (static: no secret-bearing ARG/ENV name/value — the only ENV is NODE_ENV=production — no COPY of .env/credential paths, no blanket COPY . .); "the build context excludes env and credential files (.dockerignore)" (static: every **/-prefixed secret pattern present verbatim, nested example paths + root forms excluded under Docker's own matcher semantics, no redundant equivalent patterns required, image inputs kept); "the committed files copied into the image contain no default credential values" (static scan of the files the Dockerfile copies). Mutation probes prove non-vacuous: adding ENV POSTGRES_PASSWORD=…, ARG DATABASE_URL=…, a credential-URI ENV, COPY .env, COPY . ., removing **/.env.*/**/*.key, replacing a **/ pattern with its root-anchored bare form, or adding redundant secrets+secrets/ — all fail
image layers contain no secret values	tests/secrets-not-embedded.test.mjs — "the built image layers contain no secret values (docker build + layer scan)" (Docker-gated): docker build the committed image with marker probe files planted at the root (**/.env.*) AND at nested paths swept by COPY apps/server apps/server (apps/server/.env.t08-*, apps/server/secrets/t08-*.pem), docker save + extract, scan every layer (raw + gunzipped) and the image config — the probe markers and postgres://eppp:eppp@db:5432/eppp must appear nowhere
the guarantee is enforced in CI	.gitea/workflows/ci.yml — secrets-not-embedded job runs node --test tests/secrets-not-embedded.test.mjs on every PR (static assertions gate merges; the layer-scan probe runs where a Docker daemon exists and skips cleanly otherwise)

Test plan executed

• node --test tests/secrets-not-embedded.test.mjs → 15/15 pass, 1 skipped (the Docker-gated layer-scan probe skips cleanly where no Docker daemon exists; this sandbox has none).
• node --test tests/*.test.mjs (full suite) → 101 pass / 12 fail / 8 skip; the 12 failures are identical to clean main (frozen-install / root-commands / strict-tsconfig / node-engine / typescript-pin suites need pnpm install + Node 24, absent here: no node_modules, Node 22.23.2) — zero new failures, +2 secrets tests net.
• The matcher port was verified against the moby/patternmatcher evidence table (slash-less .npmrc/*.key/secrets do NOT match nested paths; **/-prefixed forms match at the root and any depth; parent-directory propagation prunes matched dirs).
• CI (Actions run #77/#78): secrets-not-embedded job → 16 tests, 15 pass / 1 skip (no Docker daemon in the runner container), job green; Frozen lockfile install green. The static assertions now gate every PR.

Risks / notes

• The image itself needed no functional change — it already embedded no secrets; T08 makes the guarantee explicit, Docker-faithful and testable (.dockerignore hardening + static/mutation tests + nested-marker layer-scan probe + CI enforcement).
• The layer-scan probe uses a unique tag and unique markers per run (.env.t08-<uuid>, apps/server/.env.t08-<uuid>, apps/server/secrets/t08-<uuid>.pem, all matched by the **/-prefixed exclusions), so it cannot collide with a developer's real files and cannot pass on a stale cache; probe files are removed in finally (the transient apps/server/secrets/ dir only if the probe created it).
• Docker-gated tests skip without a daemon, so the suite stays green everywhere while giving real layer-scan validation where Docker exists (same pattern as T01..T07).

Refs #175

## What changed Implements [E00-S02-T08] Secrets are not embedded in image (#175) on top of the [E00-S02-T01..T07] Compose baseline (#59): the workspace server application image carries **no secrets** — statically guaranteed by the committed Dockerfile and `.dockerignore`, and verified end to end by scanning a built image's layers. This revision resolves the security review of the previous head (issuecomment-2784, findings 1–4) against the reworked acceptance criteria: - **`.dockerignore` — exclusions now apply at the root AND at any depth.** Every env/credential pattern is `**/`-prefixed: `**/.env`, `**/.env.*`, `**/node_modules`, `**/.npmrc`, `**/.netrc`, `**/.credentials`, `**/.aws`, `**/.ssh`, `**/secrets`, `**/*.pem`, `**/*.key`, `**/*.p12`, `**/*.pfx`, `**/*.jks`, `**/id_rsa`, `**/id_ed25519`. Docker's real matcher (moby/patternmatcher) anchors slash-less patterns to the context root, so the previous bare `.npmrc`/`*.key`/`secrets` forms excluded nothing under `apps/server/…` (finding 1). The redundant `secrets/` duplicate is gone (finding 3). - **`tests/secrets-not-embedded.test.mjs` — the matcher is now Docker-faithful.** It is a port of moby/patternmatcher (`filepath.Clean` + anchored full-path match + parent-directory propagation), not gitignore basename semantics; it asserts the nested example paths (`apps/server/.npmrc`, `config/server.key`, `apps/server/secrets/…`) are excluded, requires the `**/`-prefixed forms verbatim, and requires no redundant equivalent patterns (finding 2/3). The Docker-gated layer-scan probe now plants marker files at nested paths the Dockerfile's `COPY apps/server apps/server` would sweep in (`apps/server/.env.t08-*`, `apps/server/secrets/t08-*.pem`), so a nested-context leak is observable end to end. - **`apps/server/Dockerfile` + `compose.yaml` — the guarantee is stated precisely**: credential files are excluded from the build context at the root and at any depth, so a local secret file cannot be embedded even by mistake (finding 3). - **`.gitea/workflows/ci.yml` — the guarantee is enforced in CI**: a new `secrets-not-embedded` job runs `node --test tests/secrets-not-embedded.test.mjs` on every PR; the Docker-gated layer-scan probe runs where a Docker daemon is reachable and skips cleanly otherwise (finding 4). - `tests/compose-config.test.mjs` — the `.dockerignore` presence list updated to the `**/`-prefixed forms. Runtime credentials (e.g. `DATABASE_URL`) remain Compose-injected at run time (`compose.yaml` `app.environment`), never baked into the image. Explicitly out of scope per the brief, **not touched**: multi-arch build targets (E00-S02-T07 — unchanged behavior), app health endpoint (E00-S02-T03). ## Criterion → test table | Acceptance criterion | Test (fails without the committed state) | | --- | --- | | `secrets are not embedded in the image` | `tests/secrets-not-embedded.test.mjs` — **"the app image embeds no secrets (Dockerfile declares no secret ENV/ARG and copies no secret paths)"** (static: no secret-bearing `ARG`/`ENV` name/value — the only ENV is `NODE_ENV=production` — no `COPY` of `.env`/credential paths, no blanket `COPY . .`); **"the build context excludes env and credential files (.dockerignore)"** (static: every `**/`-prefixed secret pattern present verbatim, nested example paths + root forms excluded under Docker's own matcher semantics, no redundant equivalent patterns required, image inputs kept); **"the committed files copied into the image contain no default credential values"** (static scan of the files the Dockerfile copies). Mutation probes prove non-vacuous: adding `ENV POSTGRES_PASSWORD=…`, `ARG DATABASE_URL=…`, a credential-URI `ENV`, `COPY .env`, `COPY . .`, removing `**/.env.*`/`**/*.key`, replacing a `**/` pattern with its root-anchored bare form, or adding redundant `secrets`+`secrets/` — all fail | | `image layers contain no secret values` | `tests/secrets-not-embedded.test.mjs` — **"the built image layers contain no secret values (docker build + layer scan)"** (Docker-gated): `docker build` the committed image with marker probe files planted at the root (`**/.env.*`) AND at nested paths swept by `COPY apps/server apps/server` (`apps/server/.env.t08-*`, `apps/server/secrets/t08-*.pem`), `docker save` + extract, scan every layer (raw + gunzipped) and the image config — the probe markers and `postgres://eppp:eppp@db:5432/eppp` must appear nowhere | | `the guarantee is enforced in CI` | `.gitea/workflows/ci.yml` — **`secrets-not-embedded` job** runs `node --test tests/secrets-not-embedded.test.mjs` on every PR (static assertions gate merges; the layer-scan probe runs where a Docker daemon exists and skips cleanly otherwise) | ## Test plan executed - `node --test tests/secrets-not-embedded.test.mjs` → **15/15 pass, 1 skipped** (the Docker-gated layer-scan probe skips cleanly where no Docker daemon exists; this sandbox has none). - `node --test tests/*.test.mjs` (full suite) → **101 pass / 12 fail / 8 skip**; the **12 failures are identical to clean `main`** (frozen-install / root-commands / strict-tsconfig / node-engine / typescript-pin suites need `pnpm install` + Node 24, absent here: no `node_modules`, Node 22.23.2) — **zero new failures**, +2 secrets tests net. - The matcher port was verified against the moby/patternmatcher evidence table (slash-less `.npmrc`/`*.key`/`secrets` do NOT match nested paths; `**/`-prefixed forms match at the root and any depth; parent-directory propagation prunes matched dirs). - **CI (Actions run #77/#78)**: `secrets-not-embedded` job → 16 tests, 15 pass / 1 skip (no Docker daemon in the runner container), **job green**; `Frozen lockfile install` green. The static assertions now gate every PR. ## Risks / notes - The image itself needed no functional change — it already embedded no secrets; T08 makes the guarantee explicit, Docker-faithful and testable (`.dockerignore` hardening + static/mutation tests + nested-marker layer-scan probe + CI enforcement). - The layer-scan probe uses a unique tag and unique markers per run (`.env.t08-<uuid>`, `apps/server/.env.t08-<uuid>`, `apps/server/secrets/t08-<uuid>.pem`, all matched by the `**/`-prefixed exclusions), so it cannot collide with a developer's real files and cannot pass on a stale cache; probe files are removed in `finally` (the transient `apps/server/secrets/` dir only if the probe created it). - Docker-gated tests `skip` without a daemon, so the suite stays green everywhere while giving real layer-scan validation where Docker exists (same pattern as T01..T07). Refs #175

bot-implementer added 2 commits 2026-08-29 01:28:42 +00:00

feat: keep secrets out of the app image (E00-S02-T08) ... 0938da8a73

- .dockerignore: exclude env + credential files (.npmrc, .netrc, .aws, .ssh,
  secrets/, *.pem, *.key, *.p12, *.pfx, *.jks, id_rsa, id_ed25519, ...) from
  the build context so a local secret file cannot be embedded in the image
- Dockerfile: document the T08 guarantee (no secret ARG/ENV, fixed non-secret
  COPY paths, runtime credentials via Compose environment)
- compose.yaml: T08 in scope; runtime credentials stay in service environment,
  never in the image

test: lock in no-secrets-in-image criteria (E00-S02-T08) ... b3ad55efe8

tests/secrets-not-embedded.test.mjs: static assertions that the Dockerfile
embeds no secrets (no secret-bearing ARG/ENV, no secret-path or blanket COPY)
and .dockerignore excludes env/credential files; non-vacuous mutation probes
for every assertion; Docker-gated probe that builds the image with a marker
env file in the context and scans every layer + image config for secret
values.

bot-implementer referenced this issue from a commit 2026-08-29 01:49:14 +00:00

fix: make .dockerignore exclusions apply at any depth (E00-S02-T08)

bot-implementer added 1 commit 2026-08-29 01:49:14 +00:00

fix: make .dockerignore exclusions apply at any depth (E00-S02-T08) ... f00c13d57a

Resolve the security review of #389 (findings 1-4):

- .dockerignore: every env/credential pattern is now **/-prefixed
  (**/.env, **/.env.*, **/node_modules, **/.npmrc, ..., **/secrets,
  **/*.pem, **/*.key, ...) and the redundant 'secrets/' line is dropped.
  Docker's matcher (moby/patternmatcher) anchors slash-less patterns to
  the context root, so the bare forms excluded nothing under apps/server/;
  **/ matches the root AND any nested depth. (finding 1, 3)
- tests/secrets-not-embedded.test.mjs: the dockerignore matcher is now a
  faithful port of moby/patternmatcher (filepath.Clean + anchored full-path
  match + parent-directory propagation), not gitignore basename semantics;
  asserts nested example paths (apps/server/.npmrc, config/server.key,
  apps/server/secrets/...) are excluded; requires no redundant equivalent
  patterns verbatim; adds mutation probes for bare-pattern and
  duplicate-pattern regressions. (finding 2, 3)
- apps/server/Dockerfile + compose.yaml: guarantee restated precisely
  (credential files excluded at the context root AND at any depth).
- .gitea/workflows/ci.yml: new job runs
  'node --test tests/secrets-not-embedded.test.mjs' on every PR; the
  docker-gated layer-scan probe runs where a daemon exists, skips cleanly
  otherwise. (finding 4)
- tests/compose-config.test.mjs: .dockerignore presence list updated to the
  **/-prefixed forms (node_modules, .env).

Tested: secrets suite 16 tests -> 15 pass / 1 docker-gated skip / 0 fail;
full suite 101 pass / 12 fail / 8 skip, failures identical to clean main
(env-dependent pnpm/Node-24 suites); matcher port verified against the
moby/patternmatcher evidence table.

bot-implementer added 1 commit 2026-08-29 01:54:01 +00:00

test: plant nested marker files in the layer-scan probe (E00-S02-T08) ... 719fb4380b

The Docker-gated probe only planted a root-level .env.t08-* marker, which no
Dockerfile COPY instruction ever copies — so it could not observe a nested
build-context leak in the image layers. Plant additional marker files at
nested paths the Dockerfile's COPY apps/server apps/server would sweep into
the build-stage image (apps/server/.env.t08-*, apps/server/secrets/t08-*.pem)
so the end-to-end scan actually verifies the 'any depth' exclusion
guarantee, not just the root form.

bot-tester commented 2026-08-29 01:58:39 +00:00

Member

Copy Link

Copy Source

agent: tester
phase: start
issue: "#175"
pr: "389"
title: "[E00-S02-T08] Secrets are not embedded in image"
objective: independently probe the PR for #175
scope_files: []
constraints:
  - never edit the implementer's tests in the same PR
acceptance:
  - secrets are not embedded in the image
  - image layers contain no secret values
plan:
  - checkout feature/175 (head f00c13d) independently
  - static-verify apps/server/Dockerfile (no secret ENV/ARG, fixed non-secret COPY paths, no COPY . .)
  - static-verify .dockerignore (all **/-prefixed env/credential patterns, root + nested depth)
  - grep tracked files for the compose default credential values (postgres://eppp:eppp@db:5432/eppp, eppp)
  - run tests/secrets-not-embedded.test.mjs independently (never editing it)
  - run full suite and compare failing set against clean main
  - independently review the dockerignore matcher port for Docker/moby faithfulness
  - attempt a real docker build + layer scan (if a daemon is available)
  - collect Gitea Actions CI run links
  - post end-of-probe evidence comment with CI links
environment:
  node: v22.23.2
  pnpm: unavailable (not on PATH)
  docker: unavailable (no docker/podman/buildah/skopeo binary, no /var/run/docker.sock) — real layer-scan will be verified statically + via CI evidence
status: started

```yaml agent: tester phase: start issue: "#175" pr: "389" title: "[E00-S02-T08] Secrets are not embedded in image" objective: independently probe the PR for #175 scope_files: [] constraints: - never edit the implementer's tests in the same PR acceptance: - secrets are not embedded in the image - image layers contain no secret values plan: - checkout feature/175 (head f00c13d) independently - static-verify apps/server/Dockerfile (no secret ENV/ARG, fixed non-secret COPY paths, no COPY . .) - static-verify .dockerignore (all **/-prefixed env/credential patterns, root + nested depth) - grep tracked files for the compose default credential values (postgres://eppp:eppp@db:5432/eppp, eppp) - run tests/secrets-not-embedded.test.mjs independently (never editing it) - run full suite and compare failing set against clean main - independently review the dockerignore matcher port for Docker/moby faithfulness - attempt a real docker build + layer scan (if a daemon is available) - collect Gitea Actions CI run links - post end-of-probe evidence comment with CI links environment: node: v22.23.2 pnpm: unavailable (not on PATH) docker: unavailable (no docker/podman/buildah/skopeo binary, no /var/run/docker.sock) — real layer-scan will be verified statically + via CI evidence status: started ```

bot-tester commented 2026-08-29 01:59:47 +00:00

Member

Copy Link

Copy Source

agent: tester
phase: end
issue: "#175"
pr: "389"
head_sha: f00c13d57ae81eb1662dc1208a61d8068024beaa
verdict: PASS
verdict_scope: statically verified (Dockerfile + .dockerignore + source scan + test suite + CI); runtime docker layer-scan unexecuted — no Docker locally and CI job has no daemon

acceptance:
  - criterion: secrets are not embedded in the image
    result: PASS
    evidence:
      - "apps/server/Dockerfile independently parsed: the ONLY ENV is `ENV NODE_ENV=production`; zero ARG instructions; zero secret-bearing values"
      - "COPY instructions (independently listed): manifests (package.json, pnpm-lock.yaml, pnpm-workspace.yaml, tsconfig.base.json, apps/server/package.json, packages/core/package.json, extensions/example/package.json), `apps/server apps/server`, then stage-only `--from=build` copies of node_modules/dist/package.json — all fixed non-secret paths; no `COPY . .`, no .env/credential COPY"
      - "broad secret-pattern grep (password|secret|token|api_key|private_key|BEGIN *PRIVATE KEY|postgres://eppp:eppp@db:5432/eppp) over the files the image copies (apps/server/src, packages/*, extensions/*, root manifests) → 0 matches (only Dockerfile doc comments mention the words)"
      - "`node --test tests/secrets-not-embedded.test.mjs` → 16 tests: 15 pass / 0 fail / 1 skip, exit 0 (independently executed, test file never edited)"
      - "mutation probes non-vacuous: adding secret ENV, secret ARG, credential-URI ENV, long-secret ENV, COPY .env, blanket COPY . ., dropping **/.env.* / **/*.key, bare `secrets`, redundant `secrets`+`secrets/` — all fail"
    runtime_note: "runtime image-content proof is the Docker-gated layer-scan probe (SKIPPED locally: no docker binary/daemon; and SKIPPED in CI: the secrets-not-embedded job runs `node --test` only, no Docker daemon in its container)"

  - criterion: image layers contain no secret values
    result: PASS (static guarantee; runtime scan not exercised)
    evidence:
      - "Final runtime stage COPYs only `node_modules` (pnpm install of public deps), `apps/server/dist` (tsc output of clean source), and `apps/server/package.json` — none derived from any secret-bearing input; no ARG/ENV carries a secret into the image config"
      - "compose default credentials `postgres://eppp:eppp@db:5432/eppp` / `eppp` exist ONLY in compose.yaml service `environment:` (runtime injection), never in any file the Dockerfile COPYs (independently grepped)"
      - "the committed layer-scan probe encodes the exact acceptance sequence: docker build from repo root with a marker `.env.t08-*` in context → docker save → extract → scan every layer (raw + gunzipped) and image config for the marker and compose credential values"
    runtime_note: "this probe reports `# SKIP` both here (no Docker) and in CI (job has no daemon), so no actual `docker build`+`docker save`+layer scan has executed in automation — the criterion is currently enforced statically, which is sound given the fixed COPY paths, but a Docker-enabled runner would exercise the literal layer scan"

  - criterion: build context excludes credential files at root AND nested depth (.dockerignore **/-prefixed)
    result: PASS
    evidence:
      - ".dockerignore independently inspected: all 16 required env/credential patterns present verbatim in **/-prefixed form (**/.env, **/.env.*, **/node_modules, **/.npmrc, **/.netrc, **/.credentials, **/.aws, **/.ssh, **/secrets, **/*.pem, **/*.key, **/*.p12, **/*.pfx, **/*.jks, **/id_rsa, **/id_ed25519)"
      - "pre-PR bare patterns (node_modules, .env, .env.*) were root-anchored only; **/-prefixing is the correct Docker fix (moby/patternmatcher anchors slash-less patterns to the context root)"
      - "nested example paths asserted excluded: apps/server/.npmrc, config/server.key, apps/server/secrets/db.pem, apps/server/.env, apps/server/.env.local, apps/server/node_modules/pkg/index.js, root .npmrc — all match"

  - criterion: test matcher is faithful to Docker .dockerignore semantics (not gitignore)
    result: PASS
    evidence:
      - "independently reviewed the ported compile/match logic: filepath.Clean + anchored full-path match + parent-directory propagation; leading `**/` → optional any-segments group / suffix match; trailing `**` → prefix; `*`/`?` → `[^/]*`/`[^/]`"
      - "parser probe confirms bare `.npmrc` / `*.key` / `secrets` / `.env` do NOT match nested paths (root-anchored) while **/-prefixed forms DO — consistent with real moby/patternmatcher behavior"

  - criterion: guarantee enforced in CI
    result: PASS
    evidence:
      - ".gitea/workflows/ci.yml adds job `secrets-not-embedded` (Node 24 + `node --test tests/secrets-not-embedded.test.mjs`) on every PR"
      - "latest PR run #77 succeeded; job `Secrets not embedded (E00-S02-T08)` log shows 15 pass / 0 fail / 1 skip"

regression:
  - "full suite `node --test tests/*.test.mjs` → 121 tests: 101 pass / 12 fail / 8 skip (exit 1)"
  - "the 12 failures are IDENTICAL by name on clean `main` (independent worktree diff): frozen-install (4), node-engine (1), root-commands (3), strict-tsconfig (2), typescript-pin (2) — all require `pnpm install` + Node 24, absent here (Node v22.23.2, no pnpm). Branch adds +15 pass / +1 skip / 0 new failures"

changes_reviewed:
  - ".dockerignore — correct; env/credential exclusions hardened to **/-prefixed forms; redundant `secrets/` removed"
  - "apps/server/Dockerfile — comment-only header; no runtime behavior change; still only NODE_ENV ENV, no ARG"
  - "compose.yaml — comment-only + title bump; runtime credentials remain in service environment, never baked"
  - ".gitea/workflows/ci.yml — new secrets-not-embedded job gates every PR (static assertions; layer-scan probe skips without Docker)"
  - "tests/compose-config.test.mjs — .dockerignore presence list updated to **/-prefixed forms"
  - "tests/secrets-not-embedded.test.mjs — new 808-line suite (static + mutation + parser + Docker-gated probe). Not edited by tester"

limitations:
  - "No Docker daemon locally (no docker/podman/buildah/skopeo, no /var/run/docker.sock) and none in the CI secrets-not-embedded job, so the literal 'docker build + docker save + layer scan' has not executed in automation. The 'image layers contain no secret values' criterion is currently enforced statically (no secret ENV/ARG/COPY + no credentials in copied files) — sound given the fixed COPY paths — but a Docker-enabled CI runner would close the runtime-evidence gap."
  - "Local toolchain is Node v22.23.2 (engines want 24) without pnpm; the 12 pre-existing failures are environmental and identical on main."

ci_links:
  - run: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/77"        # pull_request @ head f00c13d, conclusion: success
  - job: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/77/jobs/90"  # Secrets not embedded (E00-S02-T08), success, 15 pass/1 skip
  - job: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/77/jobs/89"  # Frozen lockfile install, success
  - workflow: "http://gitea:3000/Fabrika/PersonalBlog/src/branch/main/.gitea/workflows/ci.yml"
  - pr: "http://gitea:3000/Fabrika/PersonalBlog/pulls/389"
  - issue: "http://gitea:3000/Fabrika/PersonalBlog/issues/175"

done_when: evidence comment posted with CI links
status: done

```yaml agent: tester phase: end issue: "#175" pr: "389" head_sha: f00c13d57ae81eb1662dc1208a61d8068024beaa verdict: PASS verdict_scope: statically verified (Dockerfile + .dockerignore + source scan + test suite + CI); runtime docker layer-scan unexecuted — no Docker locally and CI job has no daemon acceptance: - criterion: secrets are not embedded in the image result: PASS evidence: - "apps/server/Dockerfile independently parsed: the ONLY ENV is `ENV NODE_ENV=production`; zero ARG instructions; zero secret-bearing values" - "COPY instructions (independently listed): manifests (package.json, pnpm-lock.yaml, pnpm-workspace.yaml, tsconfig.base.json, apps/server/package.json, packages/core/package.json, extensions/example/package.json), `apps/server apps/server`, then stage-only `--from=build` copies of node_modules/dist/package.json — all fixed non-secret paths; no `COPY . .`, no .env/credential COPY" - "broad secret-pattern grep (password|secret|token|api_key|private_key|BEGIN *PRIVATE KEY|postgres://eppp:eppp@db:5432/eppp) over the files the image copies (apps/server/src, packages/*, extensions/*, root manifests) → 0 matches (only Dockerfile doc comments mention the words)" - "`node --test tests/secrets-not-embedded.test.mjs` → 16 tests: 15 pass / 0 fail / 1 skip, exit 0 (independently executed, test file never edited)" - "mutation probes non-vacuous: adding secret ENV, secret ARG, credential-URI ENV, long-secret ENV, COPY .env, blanket COPY . ., dropping **/.env.* / **/*.key, bare `secrets`, redundant `secrets`+`secrets/` — all fail" runtime_note: "runtime image-content proof is the Docker-gated layer-scan probe (SKIPPED locally: no docker binary/daemon; and SKIPPED in CI: the secrets-not-embedded job runs `node --test` only, no Docker daemon in its container)" - criterion: image layers contain no secret values result: PASS (static guarantee; runtime scan not exercised) evidence: - "Final runtime stage COPYs only `node_modules` (pnpm install of public deps), `apps/server/dist` (tsc output of clean source), and `apps/server/package.json` — none derived from any secret-bearing input; no ARG/ENV carries a secret into the image config" - "compose default credentials `postgres://eppp:eppp@db:5432/eppp` / `eppp` exist ONLY in compose.yaml service `environment:` (runtime injection), never in any file the Dockerfile COPYs (independently grepped)" - "the committed layer-scan probe encodes the exact acceptance sequence: docker build from repo root with a marker `.env.t08-*` in context → docker save → extract → scan every layer (raw + gunzipped) and image config for the marker and compose credential values" runtime_note: "this probe reports `# SKIP` both here (no Docker) and in CI (job has no daemon), so no actual `docker build`+`docker save`+layer scan has executed in automation — the criterion is currently enforced statically, which is sound given the fixed COPY paths, but a Docker-enabled runner would exercise the literal layer scan" - criterion: build context excludes credential files at root AND nested depth (.dockerignore **/-prefixed) result: PASS evidence: - ".dockerignore independently inspected: all 16 required env/credential patterns present verbatim in **/-prefixed form (**/.env, **/.env.*, **/node_modules, **/.npmrc, **/.netrc, **/.credentials, **/.aws, **/.ssh, **/secrets, **/*.pem, **/*.key, **/*.p12, **/*.pfx, **/*.jks, **/id_rsa, **/id_ed25519)" - "pre-PR bare patterns (node_modules, .env, .env.*) were root-anchored only; **/-prefixing is the correct Docker fix (moby/patternmatcher anchors slash-less patterns to the context root)" - "nested example paths asserted excluded: apps/server/.npmrc, config/server.key, apps/server/secrets/db.pem, apps/server/.env, apps/server/.env.local, apps/server/node_modules/pkg/index.js, root .npmrc — all match" - criterion: test matcher is faithful to Docker .dockerignore semantics (not gitignore) result: PASS evidence: - "independently reviewed the ported compile/match logic: filepath.Clean + anchored full-path match + parent-directory propagation; leading `**/` → optional any-segments group / suffix match; trailing `**` → prefix; `*`/`?` → `[^/]*`/`[^/]`" - "parser probe confirms bare `.npmrc` / `*.key` / `secrets` / `.env` do NOT match nested paths (root-anchored) while **/-prefixed forms DO — consistent with real moby/patternmatcher behavior" - criterion: guarantee enforced in CI result: PASS evidence: - ".gitea/workflows/ci.yml adds job `secrets-not-embedded` (Node 24 + `node --test tests/secrets-not-embedded.test.mjs`) on every PR" - "latest PR run #77 succeeded; job `Secrets not embedded (E00-S02-T08)` log shows 15 pass / 0 fail / 1 skip" regression: - "full suite `node --test tests/*.test.mjs` → 121 tests: 101 pass / 12 fail / 8 skip (exit 1)" - "the 12 failures are IDENTICAL by name on clean `main` (independent worktree diff): frozen-install (4), node-engine (1), root-commands (3), strict-tsconfig (2), typescript-pin (2) — all require `pnpm install` + Node 24, absent here (Node v22.23.2, no pnpm). Branch adds +15 pass / +1 skip / 0 new failures" changes_reviewed: - ".dockerignore — correct; env/credential exclusions hardened to **/-prefixed forms; redundant `secrets/` removed" - "apps/server/Dockerfile — comment-only header; no runtime behavior change; still only NODE_ENV ENV, no ARG" - "compose.yaml — comment-only + title bump; runtime credentials remain in service environment, never baked" - ".gitea/workflows/ci.yml — new secrets-not-embedded job gates every PR (static assertions; layer-scan probe skips without Docker)" - "tests/compose-config.test.mjs — .dockerignore presence list updated to **/-prefixed forms" - "tests/secrets-not-embedded.test.mjs — new 808-line suite (static + mutation + parser + Docker-gated probe). Not edited by tester" limitations: - "No Docker daemon locally (no docker/podman/buildah/skopeo, no /var/run/docker.sock) and none in the CI secrets-not-embedded job, so the literal 'docker build + docker save + layer scan' has not executed in automation. The 'image layers contain no secret values' criterion is currently enforced statically (no secret ENV/ARG/COPY + no credentials in copied files) — sound given the fixed COPY paths — but a Docker-enabled CI runner would close the runtime-evidence gap." - "Local toolchain is Node v22.23.2 (engines want 24) without pnpm; the 12 pre-existing failures are environmental and identical on main." ci_links: - run: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/77" # pull_request @ head f00c13d, conclusion: success - job: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/77/jobs/90" # Secrets not embedded (E00-S02-T08), success, 15 pass/1 skip - job: "http://gitea:3000/Fabrika/PersonalBlog/actions/runs/77/jobs/89" # Frozen lockfile install, success - workflow: "http://gitea:3000/Fabrika/PersonalBlog/src/branch/main/.gitea/workflows/ci.yml" - pr: "http://gitea:3000/Fabrika/PersonalBlog/pulls/389" - issue: "http://gitea:3000/Fabrika/PersonalBlog/issues/175" done_when: evidence comment posted with CI links status: done ```

kpcto merged commit 38c17f0e7a into main 2026-08-29 10:40:37 +00:00

kpcto deleted branch feature/175 2026-08-29 10:40:37 +00:00

kpcto referenced this pull request 2026-08-29 11:01:10 +00:00

[E00-S03-T01] PostgreSQL 18.6 container #176

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

agent/analyst-drafted

agent/analyst-drafted

kind

bug

kind

bug

kind

epic

kind

epic

kind

initiative

EPPP programme initiative

kind

story

kind

story

kind

task

EPPP engineering card/task decomposed from a story

kind

toil

kind

toil

loop

1

loop

1

loop

2

loop

2

loop

3

loop

3

needs/human-decision

needs/human-decision

needs/security-review

needs/security-review

risk

agent-full

risk

agent-full

risk

human-gated

risk

human-gated

risk

human-only

risk

human-only

size

l

size

l

size

m

size

m

size

s

size

s

status

blocked

status

blocked

status

done

Workflow: Done

status

in-progress

status

in-progress

status

proposed

status

proposed

status

ready

status

ready

status

review

status

review

stream

checkout

stream

checkout

stream

onboarding

stream

onboarding

stream

platform

stream

platform

tier/t0

trivial — implementer only, auto-merge

tier/t1

standard — implementer + reviewer + tester

tier/t2

complex — security if triggered, human merge

tier/t3

critical — full chain + security, human merge

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

bot-analyst bot-dispatcher bot-implementer bot-migrations bot-reviewer bot-security bot-tester kpcto

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Fabrika/PersonalBlog#389