fix(config): require explicit Config Server repository authority

[seonghobae]

Purpose

Advance #179 with a path-disjoint fail-closed slice from protected develop@622e5e6c3d534f230c390f10e3832efadfc01825. The Config Server module historically defaulted CONFIG_REPO_URI to https://github.com/your-repo/config-repo.git, so a missing deployment decision silently became a fake external Git destination.

This PR does not promote Config Server to a supported default topology, modify .replit (owned by #169), modify the canonical documentation spine (owned by #149), add credentials, or change Config Server authentication. It establishes one narrower invariant that is valid whether Config Server remains reference-only or is later promoted: repository authority must be explicit and missing authority must fail closed before remote Git access.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/config-server-explicit-repo-622e5e6;
• fail-first behavior head: d0f2931580fa7db00355d9209a50ba9bac768b0e;
• behavior GREEN head: 67a94f3919af0fdc65d1ca04fd2e1e9d5e7b5016;
• documentation RED head: 680fb76b3120c7ecece90d51f631f7f1b39f5cd9;
• exact current source head: 74d684637f85af734e17a5a1f16dad44ada7dd64;
• current synthetic merge preview: 94d1d3477972cfa817429ed125fbdde497f741b0;
• GitHub mergeability: true;
• Draft: true;
• formal reviews: none;
• unresolved review threads: zero.

Every check/review from a predecessor head is historical after source movement.

RCA

• Immediate cause: spring.cloud.config.server.git.uri had a syntactically valid demo network fallback.
• Technical root cause: repository/destination authority became implicit when CONFIG_REPO_URI was missing.
• Control failure: no deterministic test prevented placeholder external Git endpoints from entering runtime configuration, and no source-backed doctoring explained repository authority, TLS, credentials, failure, rollback, or standalone/MSA implications.
• Product boundary: protected README/default Compose do not establish Config Server as a supported default service, but the module is independently runnable and therefore must not contain a fake production fallback.

TDD evidence

RED 1 — repository authority behavior (d0f2931...)

The fail-first commit added only ConfigServerRepositoryConfigurationTest. It requires exact uri: ${CONFIG_REPO_URI}, rejects your-repo/config-repo.git, and rejects an embedded HTTPS default in the placeholder.

CI run 31346298755, macOS job 93328760966, checked out GitHub synthetic merge efa8af07795540e85424b03698f5d2e73c233218 (Merge d0f2931... into 622e5e6...). ETL and CDC production/test compilation completed successfully, then Config Server production compiled and its new test ran. Exactly that test failed with zero test errors/skips because protected application.yml did not contain the explicit-only repository URI. The first failing boundary was therefore the intended deployable Config Server configuration contract, not setup/import/fixture/dependency failure.

GREEN 1 — explicit deployment-owned repository (67a94f3...)

The production correction changes exactly one configuration line:

uri: ${CONFIG_REPO_URI}

No repository URI, credential, fallback, timeout, security mode, runtime topology, or support claim is invented. Spring placeholder resolution must now receive deployment-owned repository authority instead of silently selecting a demo remote.

RED 2 — missing source-backed authority doctoring (680fb76...)

After behavior became green, the test was extended first to require docs/doctoring/config-server-repository-authority.md and source-backed treatment of Spring Cloud Config 5.0.4, spring.cloud.config.server.git.uri, CONFIG_REPO_URI, cloneOnStart, skipSslValidation, security, and APA 7 primary references.

CI run 31346618762, macOS job 93329614615, reached the Config Server test boundary with the behavior contract already green and failed only because the required doctoring artifact did not yet exist. That is valid documentation RED rather than an implementation regression.

GREEN 2 — current exact source head 74d684637f85af734e17a5a1f16dad44ada7dd64

The doctoring now records:

• explicit deployment-owned Git repository authority and fail-closed missing configuration;
• no guessed repository, credential, remote bootstrap, or TLS-verification bypass;
• cloneOnStart as a separately evaluated fail-early availability decision rather than an accidental behavior change here;
• skipSslValidation as an unsafe convenience default that this design does not enable;
• credential minimization and secret-safe observability;
• rollback that never restores the demo remote;
• standalone/MSA implications without promoting Config Server to default-supported status;
• Spring Cloud Config 5.0.4 Git backend, Security, and Config Server primary references in APA 7 form.

All currently exposed workflow aggregates associated with exact source head 74d684637f85af734e17a5a1f16dad44ada7dd64 completed successfully:

• CI 31346717059: success on macOS, Ubuntu and Windows;
• Dependency Review 31346717080: success;
• CycloneDX SBOM 31346717095: success;
• SAST Semgrep 31346717072: success;
• Security Scan 31346717067: success.

CI macOS job 93329887826 proves the current protected workflow checked out synthetic merge 94d1d3477972cfa817429ed125fbdde497f741b0 (Merge 74d6846... into 622e5e6...) rather than literal source head. On that merged tree ConfigServerRepositoryConfigurationTest passed 2/2 and the full reactor completed BUILD SUCCESS.

The same current CI log independently reproduces the inherited protected quality-control defect: JaCoCo report and check each say Analyzed bundle 'etl-service' with 0 classes, then report success. Therefore this aggregate green is not valid non-vacuous 100% owned-production coverage evidence. #162/#164 remains the separate root-cause remediation.

Accordingly, current aggregate checks are strong merged-tree compatibility/security evidence, but they do not satisfy the repository's literal-source and non-vacuous coverage acceptance contracts.

Primary references

Spring Cloud Config. (2026). Git backend (Spring Cloud Config 5.0.4). https://docs.spring.io/spring-cloud-config/reference/server/environment-repository/git-backend.html

Spring Cloud Config. (2026). Security (Spring Cloud Config 5.0.4). https://docs.spring.io/spring-cloud-config/reference/server/security.html

Spring Cloud Config. (2026). Config Server (Spring Cloud Config 5.0.4). https://docs.spring.io/spring-cloud-config/reference/server.html

Canonical PRD/TRD/Architecture/UML/security/traceability should reconcile #179/#189 only when #149's writer lane is stable; the branch-local doctoring here does not compete with that canonical spine.

Merge boundary

Keep Draft. Do not merge until the unchanged exact source head has accepted literal-source execution/security evidence under the integrated controls, non-vacuous owned-production coverage under #162/#164 or an equivalent accepted repair, zero valid unresolved review findings, and qualifying independent non-author approval where governance requires it. No predecessor-head or synthetic-merge evidence transfers after a head/base change.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b7febc25-50f1-49d3-a34e-e77fed36bd01

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Security Scan evidence correction — aggregate green is incomplete, not merge evidence

Fresh pre-write refetch confirms this PR is still Draft/mergeable on unchanged source 74d684637f85af734e17a5a1f16dad44ada7dd64 and base develop@622e5e6c3d534f230c390f10e3832efadfc01825; formal reviews and unresolved review threads remain empty.

The PR body currently describes Security Scan 31346717067 as successful merged-tree security evidence. That needs a stricter disposition after the cross-PR scanner RCA now tracked by #196. Hard Trivy job 93329887837 did both of the following:

1. checked out synthetic merge 94d1d3477972cfa817429ed125fbdde497f741b0, not literal source head 74d6846...; and
2. printed Dependency version cannot be determined. Child dependencies will not be found. before returning zero CRITICAL/HIGH/MEDIUM findings.

Therefore the aggregate green conclusion is not accepted as complete vulnerability evidence. 0 findings cannot establish absence of vulnerable BOM-managed Maven dependencies when the scanner says its dependency graph is incomplete. Source identity and dependency-resolution completeness are independent requirements; #162/#164 coverage non-vacuity is a third independent requirement.

No source change is needed in #189 for this RCA. The Config Server repository-authority behavior remains locally valid. Keep the PR Draft until an unchanged source receives accepted literal-source execution/security evidence, a complete same-revision dependency/vulnerability path with no #196 incompleteness, non-vacuous owned-production coverage, zero valid unresolved findings, and applicable qualifying independent approval. Do not suppress the Trivy warning, copy central scanner controls into this feature branch, or reinterpret aggregate green as acceptance.