Repository navigation
Conversation
prod 2026-10-19, local-ai-packaged: OPENAI_API_KEY and the Supabase API keys are provided, required: false and were empty on the build box, but the bake records every referenced key in required_env_keys, so every clone without them was refused (422 Incomplete environment) - the buyer had to type something into optional fields (and a made-up Supabase key breaks Kong). The clone check now skips keys the snapshot's contract marks optional. Tests first: 3 new tests in clone.rs failed (did not compile), then passed; clone tests 18 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012TKZy6f5shPzM9WLdswH6f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012TKZy6f5shPzM9WLdswH6f
Quick Deploy clone: a key the contract marks optional may stay empty
Only environment blocks were rewritten, so a secret the compose names in a command, an entrypoint or a healthcheck (redis --requirepass <password>, a healthcheck curl with Authorization: Bearer <ANON_KEY>) stayed the author's literal in the snapshot: every buyer of the image got the same value. The embedded-secret pass now rewrites the value-bearing service fields - environment, command, entrypoint, healthcheck (inline value or block). image, volumes, ports and the rest stay untouched, as before. Tests first: a_secret_outside_environment_blocks_is_parameterized_too failed, then passed; non_environment_blocks_are_never_rewritten (image untouched) still passes. cargo test --lib: 2279 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
env_reference_aliases collected KEY -> VAR from the whole stacker.yml into
one map and parameterize applied it to every service, so when two services
declare one env name with different references, the last one won
everywhere. Deployment #1363 (local-ai-packaged): Supabase's db got
POSTGRES_PASSWORD: ${LANGFUSE_POSTGRES_PASSWORD}, initialised its roles with
the Langfuse password, and auth/rest/storage restarted forever.
Aliases are now per service ("service/KEY", from app.environment and
services[].environment), plus by KEY alone only where every declaration of
KEY references the same variable (the old behaviour for unambiguous names;
the top-level env: counts there). parameterize looks up the compose
service's own reference first.
Tests first: one_env_name_keeps_each_services_own_reference failed, then
passed; the existing alias tests pass unchanged. cargo test --lib: 2279.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…service Compose env references: each service keeps its own
…onment Bake: parameterize secrets in command, entrypoint and healthcheck too
… at submit
Review rejects every template whose long_description is missing or too
short, but stacker had no way to supply one: `stacker submit` only sent
short_description from --description, and the documented marketplace:
block in stacker.yml was silently ignored.
- stacker.yml gains the marketplace: block from MARKETPLACE_PUBLISH.md
(display_name, short/long_description, category, tags, license, pricing,
support_url, no_secrets_confirmation). A typo'd key fails parsing
instead of being dropped.
- `stacker submit` / `stacker marketplace submit` gain --long-description
and --long-description-file plus the documented `stacker publish` alias;
CLI flags win over stacker.yml. The request body now carries
long_description, tags, currency and vendor_url.
- POST /api/templates/{id}/submit and /resubmit refuse listings whose
descriptions are missing or outside the review ranges (short 20-200,
long 100-5000 chars) before a reviewer sees them; resubmit checks the
merged values. `stacker submit` fails fast with the same rule and names
the flag or stacker.yml key to fix. `stacker config validate` warns
(W004) without blocking deploy.
Tests first: the gate tests failed against the old code and pass now.
cargo test --lib 2292 passed, marketplace suites and BDD 334 scenarios
passed; project_team_seats failures pre-exist on clean HEAD.
admin-ui asked for a 'Mark all read' button; the bell proxy had no such
route. POST /api/admin/notifications/mark-all-read forwards to User
Service's mark-all endpoint with the JWT owner's email (never a
client-supplied one), and the literal path is registered before /{id}.
Casbin policy migration mirrors the dual-prefix, multi-role convention of
20261005090000_casbin_admin_notifications_rules.
Merges duplicate stack_category spellings (crm->CRM, Data Sciense->Data Science, ai-agents->AI), re-points stack_template.category_id and rewrites tags per the mapping CSV from user/scripts/generate_category_mapping.py. --dry-run prints the diff and rolls back. Addresses the marketplace category filter finding 4 stacks for 'AI' while dozens are AI-related.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 38612145 | Triggered | Bearer Token | 4391e5c | src/cli/generator/compose.rs | View secret |
| 38612146 | Triggered | Redis Server Password | 3e83150 | src/cli/generator/compose.rs | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ); | ||
| assert!( | ||
| !result.contains("0123456789abcdef0123456789abcdef") && !result.contains(".anon'"), | ||
| "no literal left:\n{result}" |
|
|
||
| assert!( | ||
| result.contains("--requirepass ${REDIS_AUTH}"), | ||
| "command parameterized:\n{result}" |
| ); | ||
| assert!( | ||
| result.contains("\"-a\", \"${REDIS_AUTH}\""), | ||
| "healthcheck parameterized:\n{result}" |
| ); | ||
| assert!( | ||
| result.contains("Bearer ${ANON_KEY}"), | ||
| "entrypoint parameterized:\n{result}" |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Target:
main(this repo has noproductionbranch).What's included
20261023120000_casbin_admin_notifications_mark_all_read(without it the route 403s).Tests
Deploy notes