implementer
f00c13d57a
Resolve the security review of #389 (findings 1-4): - .dockerignore: every env/credential pattern is now **/-prefixed (**/.env, **/.env.*, **/node_modules, **/.npmrc, ..., **/secrets, **/*.pem, **/*.key, ...) and the redundant 'secrets/' line is dropped. Docker's matcher (moby/patternmatcher) anchors slash-less patterns to the context root, so the bare forms excluded nothing under apps/server/; **/ matches the root AND any nested depth. (finding 1, 3) - tests/secrets-not-embedded.test.mjs: the dockerignore matcher is now a faithful port of moby/patternmatcher (filepath.Clean + anchored full-path match + parent-directory propagation), not gitignore basename semantics; asserts nested example paths (apps/server/.npmrc, config/server.key, apps/server/secrets/...) are excluded; requires no redundant equivalent patterns verbatim; adds mutation probes for bare-pattern and duplicate-pattern regressions. (finding 2, 3) - apps/server/Dockerfile + compose.yaml: guarantee restated precisely (credential files excluded at the context root AND at any depth). - .gitea/workflows/ci.yml: new job runs 'node --test tests/secrets-not-embedded.test.mjs' on every PR; the docker-gated layer-scan probe runs where a daemon exists, skips cleanly otherwise. (finding 4) - tests/compose-config.test.mjs: .dockerignore presence list updated to the **/-prefixed forms (node_modules, .env). Tested: secrets suite 16 tests -> 15 pass / 1 docker-gated skip / 0 fail; full suite 101 pass / 12 fail / 8 skip, failures identical to clean main (env-dependent pnpm/Node-24 suites); matcher port verified against the moby/patternmatcher evidence table.
40 lines
851 B
Plaintext
40 lines
851 B
Plaintext
# VCS
|
|
.git
|
|
.gitignore
|
|
|
|
# Dependencies
|
|
**/node_modules
|
|
.pnpm-store
|
|
|
|
# Build output
|
|
dist
|
|
coverage
|
|
|
|
# Local environment files (a committed .env.example lands in E00-S04)
|
|
**/.env
|
|
**/.env.*
|
|
|
|
# Secrets & credentials (E00-S02-T08) — never part of the build context, so a
|
|
# secret-bearing file cannot be embedded in the image even if a developer has
|
|
# one locally. Every pattern is `**/`-prefixed because Docker's matcher
|
|
# (moby/patternmatcher) anchors a slash-less pattern to the context ROOT — a
|
|
# bare `.npmrc`/`*.key`/`secrets` would exclude nothing under `apps/server/…`.
|
|
# `**/` matches the file at the root AND at any nested depth. Keep this list
|
|
# in sync with tests/secrets-not-embedded.test.mjs.
|
|
**/.npmrc
|
|
**/.netrc
|
|
**/.credentials
|
|
**/.aws
|
|
**/.ssh
|
|
**/secrets
|
|
**/*.pem
|
|
**/*.key
|
|
**/*.p12
|
|
**/*.pfx
|
|
**/*.jks
|
|
**/id_rsa
|
|
**/id_ed25519
|
|
|
|
# Logs
|
|
*.log
|