[E00-S04-T05] .env.example contains placeholders only #404

Merged

kpcto merged 6 commits from feature/186 into main

2026-08-30 05:47:44 +00:00

Author	SHA1	Message	Date
implementer	f4a282df9e	fix: resolve security review findings on .env.example template (E00-S04-T05) CI / Frozen lockfile install (pull_request) Successful in 53s Details CI / Secrets not embedded (E00-S02-T08) (pull_request) Successful in 25s Details CI / Database-postgres import isolation (E00-S03-T02) (pull_request) Successful in 24s Details CI / Migration ledger (E00-S03-T03) (pull_request) Successful in 52s Details CI / Migration advisory lock (E00-S03-T04) (pull_request) Successful in 49s Details CI / Migration failure diagnostic (E00-S03-T05) (pull_request) Successful in 47s Details CI / App readiness after migrations (E00-S03-T06) (pull_request) Successful in 1m8s Details CI / Field-specific startup errors (E00-S04-T02) (pull_request) Successful in 1m2s Details CI / Secret redaction from logs (E00-S04-T03) (pull_request) Successful in 1m5s Details CI / Env adapter owns process.env (E00-S04-T04) (pull_request) Successful in 1m2s Details CI / TypeBox/Ajv config schema (E00-S04-T01) (pull_request) Successful in 58s Details CI / .env.example placeholders only (E00-S04-T05) (pull_request) Successful in 24s Details CI / Compose config (E00-S03-T01) (pull_request) Successful in 25s Details Addresses PR #404 review findings F2/F3/F4 on issue #186: - F3 (fail-closed): ship EPPP_SESSION_SECRET placeholder as `change-me` (9 chars), shorter than the schema's 32-character minimum, so an unedited `cp .env.example .env` is rejected at startup instead of booting with a publicly known secret. - F2 (gitleaks-clean): build the secret-shaped mutation-probe literal at runtime from short non-secret fragments; the branch no longer embeds a secret-shaped literal in the test source. - F4 (masked messages): assertion messages mask/truncate values that come from the template instead of echoing the raw string. - test: add a fail-closed length test for the EPPP_SESSION_SECRET placeholder (< 32 chars); keep mutation probes non-vacuous.	2026-08-30 05:25:34 +00:00
implementer	ec4719a8b4	docs: point at the committed .env.example template (E00-S04-T05) CI / Frozen lockfile install (pull_request) Successful in 45s Details CI / Secrets not embedded (E00-S02-T08) (pull_request) Successful in 25s Details CI / Database-postgres import isolation (E00-S03-T02) (pull_request) Successful in 26s Details CI / Migration ledger (E00-S03-T03) (pull_request) Successful in 43s Details CI / Migration advisory lock (E00-S03-T04) (pull_request) Successful in 42s Details CI / Migration failure diagnostic (E00-S03-T05) (pull_request) Successful in 49s Details CI / App readiness after migrations (E00-S03-T06) (pull_request) Successful in 1m3s Details CI / Field-specific startup errors (E00-S04-T02) (pull_request) Successful in 1m12s Details CI / Secret redaction from logs (E00-S04-T03) (pull_request) Successful in 1m6s Details CI / Env adapter owns process.env (E00-S04-T04) (pull_request) Successful in 1m8s Details CI / TypeBox/Ajv config schema (E00-S04-T01) (pull_request) Successful in 52s Details CI / .env.example placeholders only (E00-S04-T05) (pull_request) Successful in 25s Details CI / Compose config (E00-S03-T01) (pull_request) Successful in 28s Details	2026-08-30 05:12:06 +00:00
implementer	961fb0975c	ci: gate the .env.example template in CI (E00-S04-T05)	2026-08-30 05:12:06 +00:00
implementer	3b2f61c094	test: lock in .env.example placeholder-only template (E00-S04-T05)	2026-08-30 05:12:06 +00:00
implementer	6b04eac354	chore: un-ignore the committed .env.example in .gitignore (E00-S04-T05)	2026-08-30 05:12:06 +00:00
implementer	8992077bc6	feat: commit .env.example template with placeholder values only (E00-S04-T05)	2026-08-30 05:12:06 +00:00