Files
Crussell/scripts/check-env-docs.py
T
popertotsandSisyphus 5f95abf804
CI / Nginx config check (push) Failing after 7s
CI / Docker compose check (push) Failing after 7s
CI / Secrets scan (push) Failing after 7s
CI / Env docs check (push) Failing after 8s
CI / Frontend deps check (push) Failing after 23s
CI / Knip (push) Has been skipped
CI / Frontend a11y check (push) Has been skipped
CI / Go build (push) Successful in 37s
CI / Go vulnerabilities (push) Successful in 37s
CI / Frontend build (push) Successful in 1m1s
CI / go mod tidy (push) Successful in 24s
CI / Svelte strict check (push) Has been skipped
CI / Frontend QC (audit) (push) Has been skipped
CI / Frontend QC (typecheck) (push) Has been skipped
CI / Frontend QC (lint) (push) Has been skipped
CI / Go vet (push) Successful in 1m31s
CI / Staticcheck (push) Failing after 1m50s
CI / golangci-lint (push) Successful in 2m26s
CI / Security scan (gosec) (push) Failing after 2m38s
CI / Tests (prod) (push) Has been skipped
CI / Tests (dev) (push) Has been skipped
CI / Race (prod) (push) Has been skipped
CI / Race (dev) (push) Has been skipped
ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y
New jobs in pipeline:

secrets-scan: gitleaks detection
go-staticcheck: static analysis (complement to golangci-lint)
go-gosec: Go security linter
test: coverage profiling with 50% threshold gate
env-docs-check: verifies all env vars are documented in .env.example
docker-compose-check: validates compose.yml syntax
nginx-check: validates nginx config
frontend-a11y: Svelte a11y accessibility checks

Also: remove orphaned Makefile, update .env.example with 11 missing vars,
create .gitleaks.toml with allowlist, add check-env-docs.py script.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
2026-07-10 09:38:07 +01:00

75 lines
2.6 KiB
Python

#!/usr/bin/env python3
"""Check that all env vars used in the codebase are documented in .env.example."""
import os
import re
import sys
REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
def find_env_vars_in_code():
"""Find all os.Getenv() and import.meta.env.VITE_* calls in the codebase."""
env_vars = set()
# Search backend Go files for os.Getenv("VAR_NAME")
go_dir = os.path.join(REPO_ROOT, 'backend')
for root, dirs, files in os.walk(go_dir):
dirs[:] = [d for d in dirs if d not in ('vendor', '.git', 'node_modules')]
for f in files:
if f.endswith('.go'):
path = os.path.join(root, f)
with open(path) as fh:
for line in fh:
m = re.findall(r'os\.Getenv\(["\']([A-Z_][A-Z0-9_]*)["\']', line)
env_vars.update(m)
# Search frontend files for import.meta.env.VITE_*
frontend_dir = os.path.join(REPO_ROOT, 'frontend')
for root, dirs, files in os.walk(frontend_dir):
dirs[:] = [d for d in dirs if d not in ('.git', 'node_modules', 'build')]
for f in files:
if f.endswith(('.ts', '.svelte', '.js')):
path = os.path.join(root, f)
with open(path) as fh:
for line in fh:
m = re.findall(r'import\.meta\.env\.([A-Z_][A-Z0-9_]*)', line)
env_vars.update(m)
return sorted(env_vars)
def find_documented_vars():
"""Find all env vars documented in .env.example."""
env_path = os.path.join(REPO_ROOT, '.env.example')
documented = set()
if os.path.exists(env_path):
with open(env_path) as fh:
for line in fh:
line = line.strip()
if line and not line.startswith('#') and '=' in line:
var_name = line.split('=')[0].strip()
if var_name:
documented.add(var_name)
return documented
def main():
code_vars = find_env_vars_in_code()
documented = find_documented_vars()
undocumented = [v for v in code_vars if v not in documented]
if undocumented:
print("ERROR: The following env vars are used in code but not documented in .env.example:\n")
for v in undocumented:
print(f" {v}")
print(f"\nTotal: {len(undocumented)} undocumented vars out of {len(code_vars)} total")
sys.exit(1)
else:
print(f"OK: All {len(code_vars)} env vars used in code are documented in .env.example")
sys.exit(0)
if __name__ == '__main__':
main()