From c194acf3794e7453f9b65a8a8b491b3ff3965205 Mon Sep 17 00:00:00 2001 From: John O'Keefe Date: Mon, 2 Feb 2026 20:13:57 -0500 Subject: [PATCH] fix: update verify script to check git tracking, not file existence The verification script was incorrectly flagging .env files that exist locally but are properly gitignored. Now checks if files are tracked by git using 'git ls-files' instead of just checking file existence. This prevents false positives when .env is in .gitignore and exists locally for development but is not committed to the repository. --- scripts/verify-guidelines.sh | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/scripts/verify-guidelines.sh b/scripts/verify-guidelines.sh index a7e8576..b1dba14 100755 --- a/scripts/verify-guidelines.sh +++ b/scripts/verify-guidelines.sh @@ -123,10 +123,22 @@ section "General: No secrets committed" # GUIDELINE: NEVER commit files with secrets (.env, credentials.json, etc.) echo "Checking for secrets in repository..." -if [ -f ".env" ] || [ -f "credentials.json" ]; then - error_msg "Found .env or credentials.json in repository (violation: secrets committed)" +if git rev-parse --git-dir > /dev/null 2>&1; then + TRACKED_SECRETS=$(git ls-files | grep -E "^\.env$|^credentials.json$" || true) + if [ -n "$TRACKED_SECRETS" ]; then + error_msg "Found .env or credentials.json tracked in git (violation: secrets committed)" + echo "Tracked files:" + echo "$TRACKED_SECRETS" + else + success_msg "No secrets in repository" + fi else - success_msg "No secrets in repository" + # No git repo, just check if files exist + if [ -f ".env" ] || [ -f "credentials.json" ]; then + warning_msg ".env or credentials.json exist locally (ensure they're .gitignored)" + else + success_msg "No secrets in repository" + fi fi echo "Checking git history for secrets..."