clawlter/hermes-brain-web
Watch
1
0
Fork
You've already forked hermes-brain-web
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Draft: test(docker): deny local secrets from build context #24

Merged
clawlter merged 1 commit from audit/build-context-deny into main 2026-07-12 16:15:22 -04:00
Conversation 2 Commits 1 Files changed 3 +131
clawlter commented 2026-07-12 02:13:52 -04:00
Owner
Copy link

Summary

  • deny local environment files, credentials, SQLite stores, and mounted data from Docker build context
  • mirror local-only exclusions in Git while retaining env templates and test fixtures
  • cover the context policy with a focused Vitest probe

Verification

  • npm run lint
  • npm run typecheck
  • npm test (24 files, 51 tests)
  • npm run build
  • git diff --check
  • staged diff secret-pattern scan (131 added lines; no matches)

No Docker commands were run.

## Summary - deny local environment files, credentials, SQLite stores, and mounted data from Docker build context - mirror local-only exclusions in Git while retaining env templates and test fixtures - cover the context policy with a focused Vitest probe ## Verification - npm run lint - npm run typecheck - npm test (24 files, 51 tests) - npm run build - git diff --check - staged diff secret-pattern scan (131 added lines; no matches) No Docker commands were run.
test(docker): deny local secrets from build context
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 4m13s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 8m58s
Details
4b2216d53b
clawlter force-pushed audit/build-context-deny from 4b2216d53b
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 4m13s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 8m58s
Details
to 70ecf882d6
All checks were successful
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 1m13s
Details
CI / Validate lint, types, tests, and production build (pull_request) Successful in 2m21s
Details
2026-07-12 10:18:55 -04:00 Compare
clawlter commented 2026-07-12 10:20:01 -04:00
Author
Owner
Copy link

Integration staging update (unmerged): reviewed head 4b2216d53bf1f2fca884b4412c47229c1b5830ea → staged head 70ecf882d6fd6a3ed636d8b5e73072cfc1dd0143. Signed ancestry-only rebase onto main 383b526; stable patch-id confirms the reviewed aggregate delta is unchanged. Local npm ci, lint, typecheck, full Vitest, and production build all pass. Required exact-head Forgejo checks are running; this changed head remains for fresh independent review.

Integration staging update (unmerged): reviewed head `4b2216d53bf1f2fca884b4412c47229c1b5830ea` → staged head `70ecf882d6fd6a3ed636d8b5e73072cfc1dd0143`. Signed ancestry-only rebase onto main 383b526; stable patch-id confirms the reviewed aggregate delta is unchanged. Local `npm ci`, lint, typecheck, full Vitest, and production build all pass. Required exact-head Forgejo checks are running; this changed head remains for fresh independent review.
clawlter commented 2026-07-12 11:27:28 -04:00
Author
Owner
Copy link

Exact-head staging checks are green for 70ecf882d6fd6a3ed636d8b5e73072cfc1dd0143: both protected pull-request contexts succeeded. Current main is an ancestor and every staged post-main commit has a good signature. This PR remains unmerged and awaits independent staged-head review.

Exact-head staging checks are green for `70ecf882d6fd6a3ed636d8b5e73072cfc1dd0143`: both protected pull-request contexts succeeded. Current main is an ancestor and every staged post-main commit has a good signature. This PR remains unmerged and awaits independent staged-head review.
clawlter force-pushed audit/build-context-deny from 70ecf882d6
All checks were successful
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 1m13s
Details
CI / Validate lint, types, tests, and production build (pull_request) Successful in 2m21s
Details
to a718672458
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 1m51s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 5m35s
Details
2026-07-12 15:10:24 -04:00 Compare
clawlter force-pushed audit/build-context-deny from a718672458
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 1m51s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 5m35s
Details
to af02e57c97
All checks were successful
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 50s
Details
CI / Validate lint, types, tests, and production build (pull_request) Successful in 21m10s
Details
Build and publish container image / Build Docker image and publish package tags (push) Successful in 6m23s
Details
CI / Validate lint, types, tests, and production build (push) Successful in 2m53s
Details
2026-07-12 15:23:34 -04:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/hermes-brain-web!24
No description provided.