tiennm99/DocsGPT
1
0 Fork 0
mirror of https://github.com/tiennm99/DocsGPT.git synced 2026-10-12 20:15:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: tighten an existing .env to 0600 before rewriting it; CI checks secrets have values

Browse Source 
envfile.update only applied 0600 when it created the file, so an existing
.env with a wider mode kept it while secrets were written into it. The mode
is now set on the open descriptor before the file is truncated and written.

The CI step now requires POSTGRES_PASSWORD and JWT_SECRET_KEY to have values:
an empty one falls back to a default without any check noticing.
This commit is contained in:
Alex committed 2026-09-16 00:11:38 +01:00
1 parent f6bf4fefd1
commit 303f239fcd
3 files changed
+19 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/docker-image-verify.yml
+3 -2
View File
@@ -119,9 +119,10 @@ jobs:
"$docsgpt" up --yes --dir "$stack" --image-tag verify
"$docsgpt" status --dir "$stack"
curl -fsS http://127.0.0.1:7091/ | grep -q 'src="/config.js"'
grep -q '^POSTGRES_PASSWORD=' "$stack/.env"
# The secrets must have values: an empty one would fall back to a default silently.
grep -Eq '^POSTGRES_PASSWORD=.+$' "$stack/.env"
# Running up again keeps the generated secrets.
before=$(grep '^JWT_SECRET_KEY=' "$stack/.env")
before=$(grep -E '^JWT_SECRET_KEY=.+$' "$stack/.env")
"$docsgpt" up --yes --dir "$stack" --image-tag verify
[ "$(grep '^JWT_SECRET_KEY=' "$stack/.env")" = "$before" ]
"$docsgpt" uninstall --yes --purge --dir "$stack"