fix(supply-chain): exclude Docker build-context secrets

[seonghobae]

Closes #294.

Current authoritative boundary

Protected shipped truth is exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. This Draft remains the sole writer for .dockerignore plus the focused Docker build-context security contract. Current exact head is 1bd73dc4da2d48432cb93e681d6b299e66de0ff7 on fix/docker-build-context-secrets-294; the previous body claim naming 6e3d1722b5e44470d6b249cb4b1cbad8578f1396 and older protected main as current is superseded by live GitHub metadata.

This is next-release supply-chain/privacy hardening only. It adds no Docker runtime secret, network dependency, database, model/provider, transport, persistence, authorization, tenancy, credential-management, deployment or durable-audit authority.

Test-first lineage

Test-only RED 8ba8711dedcc2d85ee8fca451f53fd1fa16783a9 reached exact checkout/install/typecheck and failed the new contract because protected .dockerignore did not exclude .env or private-key material. Security Scan 31653842335 succeeded; SAST 31653842248 found a valid dynamic-RegExp defect in the initial test helper, which was repaired rather than suppressed.

The repair recursively excludes local .env*, npm/pnpm/yarn/Python registry credentials, netrc credentials and common PEM/KEY/PKCS#12 containers, with an ordered exception preserving deliberate .env.example files. The deterministic contract proves required package, lock, source, style and demo inputs remain in the context. No lifecycle script or secret-mount behavior is introduced.

Exact-current-head evidence

For unchanged exact head 1bd73dc4da2d48432cb93e681d6b299e66de0ff7 against live protected main:

• CI 32075062128: completed / success;
• Security Scan 32075062158: completed / success;
• SAST Semgrep 32075062130: completed / success;
• formal submitted reviews: one historical GitHub Advanced Security COMMENTED review, not approval;
• the only inline security thread is resolved and outdated;
• qualifying approving reviews: 0;
• GitHub reports the Draft mergeable.

Repository exact-head success is technical evidence only. Separately applicable central workflows and qualifying independent approval remain live authorities; predecessor/status/model evidence does not transfer.

Integration boundary

Keep Draft/unmerged while #118 owns the exact protected v0.6.0 publication/provenance boundary. Before any lifecycle transition refetch exact head/live base, rules/permissions, reviews/threads and every applicable repository/central workflow. Do not self-approve, weaken gates, transfer predecessor evidence, move protected main, or represent this active-PR repair as shipped.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Protected-main synchronization completed without force push.

Exact head: c16dafa0c93e5c5c2544aabe2d152b50db6f4544
Protected main merged: a40b9489665bed7d95af619a6079b9c51cab299a

Local exact-head evidence:

• Docker build-context security tests: 2 files / 4 tests passed
• root suite: 158 files / 885 tests passed; statements, branches, functions, and lines 100%
• Office suite: 173 tests passed; total coverage 100%
• TypeScript typecheck passed
• production build and packed ESM/CommonJS/strict-TypeScript consumer verification passed
• git diff --check passed

The change remains limited to .dockerignore and its deterministic security contracts; no runtime secret handling or dependency was added.

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.