CI / Nginx config check (push) Failing after 7s
CI / Docker compose check (push) Failing after 7s
CI / Secrets scan (push) Failing after 7s
CI / Env docs check (push) Failing after 8s
CI / Frontend deps check (push) Failing after 23s
CI / Knip (push) Has been skipped
CI / Frontend a11y check (push) Has been skipped
CI / Go build (push) Successful in 37s
CI / Go vulnerabilities (push) Successful in 37s
CI / Frontend build (push) Successful in 1m1s
CI / go mod tidy (push) Successful in 24s
CI / Svelte strict check (push) Has been skipped
CI / Frontend QC (audit) (push) Has been skipped
CI / Frontend QC (typecheck) (push) Has been skipped
CI / Frontend QC (lint) (push) Has been skipped
CI / Go vet (push) Successful in 1m31s
CI / Staticcheck (push) Failing after 1m50s
CI / golangci-lint (push) Successful in 2m26s
CI / Security scan (gosec) (push) Failing after 2m38s
CI / Tests (prod) (push) Has been skipped
CI / Tests (dev) (push) Has been skipped
CI / Race (prod) (push) Has been skipped
CI / Race (dev) (push) Has been skipped
New jobs in pipeline: secrets-scan: gitleaks detection go-staticcheck: static analysis (complement to golangci-lint) go-gosec: Go security linter test: coverage profiling with 50% threshold gate env-docs-check: verifies all env vars are documented in .env.example docker-compose-check: validates compose.yml syntax nginx-check: validates nginx config frontend-a11y: Svelte a11y accessibility checks Also: remove orphaned Makefile, update .env.example with 11 missing vars, create .gitleaks.toml with allowlist, add check-env-docs.py script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
75 lines
2.6 KiB
Python
75 lines
2.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Check that all env vars used in the codebase are documented in .env.example."""
|
|
|
|
import os
|
|
import re
|
|
import sys
|
|
|
|
REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
|
|
def find_env_vars_in_code():
|
|
"""Find all os.Getenv() and import.meta.env.VITE_* calls in the codebase."""
|
|
env_vars = set()
|
|
|
|
# Search backend Go files for os.Getenv("VAR_NAME")
|
|
go_dir = os.path.join(REPO_ROOT, 'backend')
|
|
for root, dirs, files in os.walk(go_dir):
|
|
dirs[:] = [d for d in dirs if d not in ('vendor', '.git', 'node_modules')]
|
|
for f in files:
|
|
if f.endswith('.go'):
|
|
path = os.path.join(root, f)
|
|
with open(path) as fh:
|
|
for line in fh:
|
|
m = re.findall(r'os\.Getenv\(["\']([A-Z_][A-Z0-9_]*)["\']', line)
|
|
env_vars.update(m)
|
|
|
|
# Search frontend files for import.meta.env.VITE_*
|
|
frontend_dir = os.path.join(REPO_ROOT, 'frontend')
|
|
for root, dirs, files in os.walk(frontend_dir):
|
|
dirs[:] = [d for d in dirs if d not in ('.git', 'node_modules', 'build')]
|
|
for f in files:
|
|
if f.endswith(('.ts', '.svelte', '.js')):
|
|
path = os.path.join(root, f)
|
|
with open(path) as fh:
|
|
for line in fh:
|
|
m = re.findall(r'import\.meta\.env\.([A-Z_][A-Z0-9_]*)', line)
|
|
env_vars.update(m)
|
|
|
|
return sorted(env_vars)
|
|
|
|
|
|
def find_documented_vars():
|
|
"""Find all env vars documented in .env.example."""
|
|
env_path = os.path.join(REPO_ROOT, '.env.example')
|
|
documented = set()
|
|
if os.path.exists(env_path):
|
|
with open(env_path) as fh:
|
|
for line in fh:
|
|
line = line.strip()
|
|
if line and not line.startswith('#') and '=' in line:
|
|
var_name = line.split('=')[0].strip()
|
|
if var_name:
|
|
documented.add(var_name)
|
|
return documented
|
|
|
|
|
|
def main():
|
|
code_vars = find_env_vars_in_code()
|
|
documented = find_documented_vars()
|
|
|
|
undocumented = [v for v in code_vars if v not in documented]
|
|
|
|
if undocumented:
|
|
print("ERROR: The following env vars are used in code but not documented in .env.example:\n")
|
|
for v in undocumented:
|
|
print(f" {v}")
|
|
print(f"\nTotal: {len(undocumented)} undocumented vars out of {len(code_vars)} total")
|
|
sys.exit(1)
|
|
else:
|
|
print(f"OK: All {len(code_vars)} env vars used in code are documented in .env.example")
|
|
sys.exit(0)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|