fix(security): ignore developer-local environment files

[seonghobae]

Purpose

Fix #213 test-first from exact protected develop@622e5e6c3d534f230c390f10e3832efadfc01825. Local deployment credentials are externalized through environment variables, but protected source historically allowed developer-local .env files to enter both Git and Docker build-context evidence paths.

This direct-develop Draft changes only root .gitignore, root .dockerignore, and one focused repository-policy test. It does not add an environment file, secret value, credential generator, Compose-password change, scanner suppression, or credential-store implementation.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: security/ignore-local-env-files-622e5e6;
• first RED source: 541a7fd875b2bbe1d37cc708481bcb59fc6f5398;
• first GREEN source: b6a673515da775505ab85bcc24c75956abaf9e80;
• second RED source: f73d4c460634a125ce0f087f81f56a56b4c01a46;
• exact current GREEN source: 3e37e937cc45d6bf40e9c6b39cf5c1de93aebe6c;
• current GitHub synthetic merge preview: 70d1f3087c0a19da4820a88c28179b47a9ba2101;
• GitHub mergeability: true;
• Draft: true;
• formal reviews: none at the latest exact-head refresh;
• unresolved review threads: zero at the latest exact-head refresh.

Every check/review from a predecessor source head is historical after movement.

RCA

• Git immediate cause: root .gitignore had no .env / .env.* rule.
• Docker immediate cause: root .dockerignore independently lacked those rules while the production Dockerfile uses COPY . . in the build stage.
• Technical root cause: secret values were externalized from application source, but the repository/build-context boundaries did not protect the common local files used to materialize those values.
• Control failure: downstream secret scanning cannot replace pre-commit/build-context exclusion. .gitignore also does not govern Docker build transfer/cache.
• Risk: database, connector, identity-provider or deployment credentials can enter commits, PR/CI history, forks, Docker build contexts/caches, remote builders, or support artifacts through ordinary developer workflow.

TDD evidence

RED 1 — Git tracking boundary

Fail-first 541a7fd875b2bbe1d37cc708481bcb59fc6f5398 added only RepositorySecretFilePolicyTest. It discovers the repository root independently of Maven module working directory and requires:

.env
.env.*
!.env.example

CI 31359234145, macOS job 93364640620, checked synthetic merge 21ebba7a3f04eeb413af67affe8615c53828e873 and ran 276 ETL tests with exactly one failure, zero errors/skips: root .gitignore did not ignore .env. This reached the intended repository-policy boundary rather than setup/import/fixture/dependency failure.

GREEN 1 — Git tracking boundary

b6a673515da775505ab85bcc24c75956abaf9e80 changed only root .gitignore and added the three rules. Hosted CI then passed the focused contract and full reactor on the merge preview.

RED 2 — Docker build-context boundary

After the Git boundary was green, test-only f73d4c460634a125ce0f087f81f56a56b4c01a46 extended the production-policy contract before .dockerignore changed. The test requires the same rules in root .dockerignore because Dockerfile uses COPY . ..

CI 31359631408, macOS job 93365758840, checked synthetic merge 397d406f81ba30e2c6d2f34f9cba199490ccffe8 and ran 277 ETL tests with exactly one failure, zero errors/skips:

RepositorySecretFilePolicyTest.localEnvironmentFilesAreExcludedFromDockerBuildContext — root .dockerignore must ignore .env.

The existing Git-boundary assertion remained green. This is valid second RED at the Docker build-context boundary.

GREEN 2 — exact current source 3e37e937cc45d6bf40e9c6b39cf5c1de93aebe6c

The smallest correction adds only the three environment-file rules to root .dockerignore. Exact comparison to RED 2 is one fast-forward commit, ahead 1 / behind 0, merge base exactly f73d4c..., with .dockerignore as the only changed file and three additions.

The final policy is therefore independently enforced by Git and Docker context boundaries while explicitly permitting a separately reviewed non-secret .env.example if one is intentionally introduced later. This PR does not create that template or imply any credential values.

Current hosted verification

Every exposed pull-request workflow aggregate associated with exact current source 3e37e937cc45d6bf40e9c6b39cf5c1de93aebe6c is terminal-success:

• CI 31359696114: success on macOS, Ubuntu and Windows;
• Dependency Review 31359696100: success;
• CycloneDX SBOM 31359696115: success;
• SAST Semgrep 31359696080: success;
• Security Scan 31359696123: success.

CI macOS job 93365948358 checked synthetic merge 70d1f3087c0a19da4820a88c28179b47a9ba2101, not the literal source head. On that integration tree:

• RepositorySecretFilePolicyTest: 2/2 green;
• ETL: 277 tests, zero failures/errors/skips;
• CDC: 106 tests, zero failures/errors/skips;
• gateway: 3 tests, zero failures/errors/skips;
• full Maven reactor: BUILD SUCCESS.

This is strong causal and merged-tree compatibility evidence, not accepted literal-source proof.

Shared evidence boundaries

The same current CI still reproduces the inherited JaCoCo false green:

Analyzed bundle 'etl-service' with 0 classes followed by All coverage checks have been met.

#162/#164 owns selected ETL non-vacuity, #205 owns repository-wide owned-production coverage scope, #121/central controls own accepted literal-source evidence, and #196 owns Maven vulnerability dependency-graph completeness. The current protected merge preview also still contains diagnostic-confidentiality defects already owned by #170–#176/#210–#212; this PR does not duplicate them.

No qualifying independent non-author formal APPROVED review exists on the exact current head. No status/check/model output is promoted to approval.

Scope / relationship

• [Security/Deployment] Remove shared default database password from published local stack #195 separately owns local Compose credential/exposure policy;
• GitHub secret scanning remains a separate downstream detection control;
• [Supply chain] Remove tracked opaque Zipkin binary and unpinned Replit bootstrap execution #168/fix(supply-chain): retire unsafe Replit Zipkin bootstrap #169 own the unrelated tracked Zipkin executable/supply-chain lane;
• [Documentation] Close canonical architecture coverage and live traceability gaps #159 owns canonical Security/Test Strategy/Traceability reconciliation;
• [Release/Supply chain] Establish reproducible exact-head artifacts and provenance #165 owns release/provenance evidence.

Merge boundary

Keep Draft. Merge only when the unchanged exact source head has accepted literal-source deterministic/security evidence, complete same-revision dependency/vulnerability evidence, non-vacuous applicable owned-production coverage, every required repository/security gate, zero valid unresolved findings, and qualifying independent non-author formal approval where governance requires it. No predecessor-head, other-PR, incomplete-scanner, status-only, skipped-required or synthetic-merge-only evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c813e252-5e88-422c-8f4c-cd1e9aaefecf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}