boban
/
clusev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(release): guard on internal-doc presence only; genericise .env.example IP 

The earlier leak guard grepped the published tree for private URL strings, but
promote.sh / promote.test.sh contain those very strings (patterns + fixture), so
it tripped on its own source and would also ship them. Switch the guard to
internal-doc presence (CLAUDE.md/rules.md/handoff.md/kickoff-prompt.md/docs) — a
reliable pre-fix-tree signal that embeds no private identifier. Genericise the
dev VM IP in .env.example (APP_URL/REVERB_HOST) to localhost.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat/v1-foundation v0.9.58
boban 2026-06-22 22:19:19 +02:00
parent 51b8572d98
commit 628c9fdbb0
3 changed files with 17 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.env.example
View File

@ -2,7 +2,7 @@ APP_NAME=Clusev
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://10.10.90.136
APP_URL=http://localhost
APP_LOCALE=de
APP_FALLBACK_LOCALE=en
@ -47,7 +47,7 @@ REVERB_APP_ID=changeme
REVERB_APP_KEY=changeme
REVERB_APP_SECRET=changeme
# client-facing (browser connects to the host-exposed port):
REVERB_HOST=10.10.90.136
REVERB_HOST=localhost
REVERB_PORT=8080
REVERB_SCHEME=http
# server bind (inside the container):

23
scripts/promote.sh
View File

@ -28,22 +28,17 @@ git -C "$src" archive --format=tar "$tag" | tar -x -C "$pub"
# Private CI never goes public.
rm -rf "${pub:?}/.github"
# Leak guard — never publish a tree that still carries a private identifier or an internal doc. This
# makes promote.sh safe even for a tag cut BEFORE the export-ignore / URL-neutralisation fixes: such
# a tree is refused (the public repo is left untouched) instead of leaking the dev/staging repos.
leak=0
# Leak guard — refuse to publish a tree that still carries an internal-only doc. These paths are
# export-ignored on current trees, so their presence means the tag predates the leak-safety fixes
# (such a tree would also ship the old private URLs + dev notes). Refuse rather than leak the
# dev/staging repos. Checking for the docs (not grepping for URL strings) keeps this guard free of
# the very identifiers it protects — so it never trips on its own source or on legitimate content.
for f in CLAUDE.md rules.md handoff.md kickoff-prompt.md docs; do
[ -e "$pub/$f" ] && { echo "leak-guard: internal path present in the tree: $f" >&2; leak=1; }
if [ -e "$pub/$f" ]; then
echo "leak-guard: REFUSING to publish $tag — internal path '$f' present; promote a tag cut after the leak-safety fixes (>= v0.9.58)." >&2
exit 1
fi
done
if grep -rIl -e 'git\.bave\.dev' -e 'boban/clusev' -e 'clusev-staging' "$pub" >/dev/null 2>&1; then
echo "leak-guard: private repo identifier in the tree to be published:" >&2
grep -rIl -e 'git\.bave\.dev' -e 'boban/clusev' -e 'clusev-staging' "$pub" >&2
leak=1
fi
if [ "$leak" -ne 0 ]; then
echo "leak-guard: REFUSING to publish $tag — promote a tag cut after the leak-safety fixes (>= v0.9.58)." >&2
exit 1
fi
git -C "$pub" add -A
# --allow-empty: stable promotion re-tags the same source commit as the last beta, so the

11
scripts/promote.test.sh
View File

@ -43,14 +43,15 @@ bash "$here/promote.sh" "$work/src" v1.0.1 "$work/pub" "Release v1.0.1"
git -C "$work/pub" rev-parse v1.0.1 >/dev/null 2>&1 || { echo "FAIL: identical-tree tag missing"; exit 1; }
git -C "$work/pub" log -1 --pretty=%s | grep -qx 'Release v1.0.1' || { echo "FAIL: identical-tree commit message"; exit 1; }
# Leak guard: a tree carrying a private identifier in a PUBLISHED file must be REFUSED, with no tag
# created (protects against promoting an old tag cut before the leak-safety fixes).
# Leak guard: a tree that still carries an internal-only doc (i.e. a tag cut before the
# export-ignore fixes) must be REFUSED, with no tag created.
git init -q "$work/leaky"
printf 'home: https://git.bave.dev/boban/clusev\n' > "$work/leaky/README.md"
printf 'app\n' > "$work/leaky/app.txt"
printf 'internal notes\n' > "$work/leaky/CLAUDE.md" # present (not export-ignored here) -> pre-fix tree
git -C "$work/leaky" add -A && git -C "$work/leaky" commit -qm init && git -C "$work/leaky" tag v9.9.9
git init -q "$work/pub2"
if bash "$here/promote.sh" "$work/leaky" v9.9.9 "$work/pub2" "Release v9.9.9" 2>/dev/null; then
echo "FAIL: leak guard did not refuse a private-identifier tree"; exit 1
echo "FAIL: leak guard did not refuse a tree carrying an internal doc"; exit 1
fi
git -C "$work/pub2" rev-parse v9.9.9 >/dev/null 2>&1 && { echo "FAIL: tag created despite leak"; exit 1; }
git -C "$work/pub2" rev-parse v9.9.9 >/dev/null 2>&1 && { echo "FAIL: tag created despite leak guard"; exit 1; }
echo "PASS"