Skip to content

fix(supply-chain): exclude local secrets from Docker build context #294

Description

@seonghobae

Current authoritative state

The Docker build-context secret-exclusion defect is repaired on canonical single-writer Draft PR #295 / branch fix/docker-build-context-secrets-294. Protected shipped truth remains exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact #295 head is 1bd73dc4da2d48432cb93e681d6b299e66de0ff7. The earlier issue snapshot naming predecessor head 6e3d1722b5e44470d6b249cb4b1cbad8578f1396 is stale and superseded.

Current .dockerignore recursively excludes local .env*, npm/pnpm/yarn/Python registry credential files, netrc credentials and common PEM/KEY/PKCS#12 private material, with an ordered exception preserving deliberate .env.example files. The executable contract proves required package, lock, source, style and demo inputs remain present. This changes only build-context admission; it adds no Docker ARG/ENV secret, secret mount, runtime network, database, model/provider, transport, persistence, authorization, tenancy, credential-management, deployment or durable-audit authority.

Test-first lineage

  • RED exact test-only head 8ba8711dedcc2d85ee8fca451f53fd1fa16783a9: CI 31653842186 reached exact checkout/install/typecheck and failed because protected .dockerignore did not exclude .env or private-key material. Security Scan 31653842335 succeeded.
  • SAST 31653842248 exposed a dynamic-RegExp defect in the first regression helper; that test defect was repaired instead of suppressed.
  • Current exact head 1bd73dc4da2d48432cb93e681d6b299e66de0ff7 carries the bounded production contract after later synchronization/head movement; predecessor workflow/review evidence does not transfer.

Exact-current-head evidence

For unchanged current #295 head:

  • CI 32075062128: completed / success;
  • Security Scan 32075062158: completed / success;
  • SAST Semgrep 32075062130: completed / success;
  • formal submitted reviews: one historical GitHub Advanced Security COMMENTED review, not approval;
  • the only inline security thread is resolved and outdated;
  • qualifying approving reviews: 0;
  • GitHub reports the Draft mergeable.

Repository exact-head technical success is not qualifying independent approval and does not replace separately applicable central workflows or protected integration.

Integration boundary

The technical defect is repaired on active Draft #295 but is not protected-main shipped truth. Keep this issue open until #295 integrates under then-live governance. Keep #295 Draft/unmerged while #118 owns exact protected v0.6.0 publication/provenance acceptance. Before any lifecycle transition refetch exact head/live base, rules/permissions, reviews/threads and every applicable repository/central workflow. Do not create a competing build-context writer, transfer predecessor evidence, self-approve, weaken gates, move protected main or fabricate release identity.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: apiAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionpriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behavior

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions