buenosairesam
a65c92257d
gen/<room>/ is the docker build context and soleprint/Dockerfile is `COPY . .`,
so anything reaching gen/ reaches an image layer — and registry.mcrn.ar is
public-read. station/tools/tester/.env has been gitignored since the last
incident, but .gitignore does not bind shutil: copy_path() called
shutil.copytree() with no ignore=, so the key was copied into every built room.
Verified extractable from soleprint_localtest-soleprint:latest (built 8 days
ago) at /app/station/tools/tester/.env.
ctrl/deploy.sh's --exclude='.env' is why this looked handled; it only covers the
rsync path, not the build-and-push path.
Two layers now:
- copy_path()/merge_into() filter .env, __pycache__, *.pyc, .git, node_modules
and virtualenvs out of bulk directory copies. Single-file copies named by a
caller are untouched, so cfg/<room>/.env.example still ships.
- soleprint/.dockerignore repeats the rule at the docker boundary and is
copied into the context beside the Dockerfile. Follows the convention
soleprint/atlas/.dockerignore already set (.env, .env.*, !.env.example).
Runtime is unaffected: no Dockerfile COPYs a .env, and the room compose files
supply it with `env_file: - .env`, read from the host at run time.
The key itself still needs rotating — it remains in git history.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
soleprint
Development workflow platform. Wraps existing applications with tools, testing, and documentation — without touching source code.
Cada paso deja huella.
Docs
cd docs && python -m http.server 8080
Visit http://localhost:8080. Start with Concepts for the mental model, then Quickstart to run your first room.