Name every environment file for its server and environment - #50
Merged
Conversation
The four environment files under secrets/ named their environment three different ways: by omission for the local production mirror, by a bare word for local staging, and by a server prefix for the two VPS files. The default file's name said nothing at all about which of the four it was, which is the one name a reader most needs, since it is what a bare make-release.sh run publishes through. Every file is now secrets/<server>.<environment>.env with both halves spelled out, matching the production-and-staging-in-every-position rule the environment name already follows because it gets compared: .env -> local.production.env staging.env -> local.staging.env vps.env -> vps.production.env vps.staging.env unchanged The gitignore's bare `.env` pattern matched nothing under the new naming, so it becomes `*.env`, which matches the shape those files are named for. deploy/env.example does not end in `.env` and stays committed. Documenting the four files by name also surfaced a wrong one: OPERATIONS.md "Checking a Site Behind the Auth Gate" sourced the local staging mirror's file for a Pangolin token that only the VPS staging file carries. The gate belongs to the VPS environment, and the local mirror sits behind Traefik and holds neither half of the pair. Verified by releasing to both local mirrors and running the live check against each: PASS, 1245 URLs honored, mirror-production and mirror-staging respectively. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Standardizes environment-file naming across the repo by making the default and documented secret env files explicitly include both server and environment (e.g., secrets/local.production.env), and updates tooling/docs to match so environment selection is unambiguous.
Changes:
- Update
deploy/make-release.shto defaultENV_FILEtosecrets/local.production.env(and update its help text accordingly). - Sweep documentation to reference
secrets/<server>.<environment>.envconsistently, including correcting the Pangolin auth-gate token source tosecrets/vps.staging.env. - Adjust
.gitignoreto ignore the new*.envnaming shape (while keepingdeploy/env.exampletracked).
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| TODO.md | Updates the referenced secrets file naming pattern in the deploy-root note. |
| README.md | Documents the <server>.<environment>.env naming and the default secrets/local.production.env. |
| OPERATIONS.md | Updates the environment table and procedures to the new env-file names; fixes which env file carries the auth-gate token. |
| deploy/README.md | Updates env-file setup instructions and documents the DEPLOY_SSH_HOST guard behavior. |
| deploy/make-release.sh | Changes the default env file to secrets/local.production.env and keeps relative-path resolution behavior. |
| deploy/env.example | Updates the template guidance and examples to the new naming scheme. |
| checks/README.md | Updates CAPTURE_ROOT documentation to point at secrets/local.production.env. |
| .gitignore | Switches the backstop ignore from .env to *.env to match the new env-file suffix. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
The DEPLOY_SSH_HOST guard exits with its own message, so the CLI help was the one place a reader could learn the requirement before hitting it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The four environment files under
secrets/named their environment three different ways: by omission for the local production mirror, by a bare word for local staging, and by a server prefix for the two VPS files. Every file is nowsecrets/<server>.<environment>.env, both halves spelled out.secrets/.envsecrets/local.production.envsecrets/staging.envsecrets/local.staging.envsecrets/vps.envsecrets/vps.production.envsecrets/vps.staging.envThe files themselves are untracked, so this PR is the script default, the template, and the prose that names them.
Why
The default file's name said nothing about which of the four environments it was, and that is the one name a reader most needs, because it is what a bare
deploy/make-release.shpublishes through. The naming also now matches the rule the environment name already follows in every other position:productionandstaging, spelled out, neverprodorstage, because the value gets compared byEXPECT_SITE_ENVand by the deploy.Also in here
.gitignore: the bare.envpattern matched nothing under the new naming, so it becomes*.env, matching the shape those files are named for.deploy/env.exampledoes not end in.envand stays committed, confirmed withgit check-ignore.OPERATIONS.md"Checking a Site Behind the Auth Gate" sourced the local staging mirror's file for a Pangolin token that only the VPS staging file carries. The gate belongs to the VPS environment; the local mirror sits behind Traefik and holds neither half of the pair. Corrected, with a sentence saying which is which.deploy/README.mdgains theDEPLOY_SSH_HOSTguard, which the file did not document: a remote environment's file describes a root on another machine, so the script asks for a local path to assemble a bundle into.Verification
CI reads no environment file, so nothing here reaches the pipeline. Checked locally instead:
==> environment: .../secrets/local.production.env.DEPLOY_SSH_HOSTset still hits the remote-root guard before building.PASS - 1245 URLs honored, served bymirror-productionandmirror-stagingrespectively.🤖 Generated with Claude Code