fix(supply-chain): exclude Docker build-context secrets

[seonghobae]

Closes #294.

Current authoritative boundary

Protected shipped truth is exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. This Draft remains the sole writer for .dockerignore plus the focused Docker build-context security contract. Current exact head is 1bd73dc4da2d48432cb93e681d6b299e66de0ff7 on fix/docker-build-context-secrets-294; the previous body claim naming 6e3d1722b5e44470d6b249cb4b1cbad8578f1396 and older protected main as current is superseded by live GitHub metadata.

This is next-release supply-chain/privacy hardening only. It adds no Docker runtime secret, network dependency, database, model/provider, transport, persistence, authorization, tenancy, credential-management, deployment or durable-audit authority.

Test-first lineage

Test-only RED 8ba8711dedcc2d85ee8fca451f53fd1fa16783a9 reached exact checkout/install/typecheck and failed the new contract because protected .dockerignore did not exclude .env or private-key material. Security Scan 31653842335 succeeded; SAST 31653842248 found a valid dynamic-RegExp defect in the initial test helper, which was repaired rather than suppressed.

The repair recursively excludes local .env*, npm/pnpm/yarn/Python registry credentials, netrc credentials and common PEM/KEY/PKCS#12 containers, with an ordered exception preserving deliberate .env.example files. The deterministic contract proves required package, lock, source, style and demo inputs remain in the context. No lifecycle script or secret-mount behavior is introduced.

Exact-current-head evidence

For unchanged exact head 1bd73dc4da2d48432cb93e681d6b299e66de0ff7 against live protected main:

• CI 32075062128: completed / success;
• Security Scan 32075062158: completed / success;
• SAST Semgrep 32075062130: completed / success;
• formal submitted reviews: one historical GitHub Advanced Security COMMENTED review, not approval;
• the only inline security thread is resolved and outdated;
• qualifying approving reviews: 0;
• GitHub reports the Draft mergeable.

Repository exact-head success is technical evidence only. Separately applicable central workflows and qualifying independent approval remain live authorities; predecessor/status/model evidence does not transfer.

Integration boundary

Keep Draft/unmerged while #118 owns the exact protected v0.6.0 publication/provenance boundary. Before any lifecycle transition refetch exact head/live base, rules/permissions, reviews/threads and every applicable repository/central workflow. Do not self-approve, weaken gates, transfer predecessor evidence, move protected main, or represent this active-PR repair as shipped.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}