docs: scripts CHANGELOG - manifest_bearer_gate.py entry (incl. the .gitignore *secret* un-tracking gotcha)

2026-07-13 15:11:46 +02:00
parent 3616dcbb7c
commit 8e69e5edda
1 changed files with 10 additions and 0 deletions
@@ -1,5 +1,15 @@
 # Felhom scripts — Changelog

+## manifest_bearer_gate.py — new gate: no bearer-shaped literals in manifests/ (2026-07-13)
+
+Part of the hub v0.53.0 bearer de-git. Greps every `manifests/*.yaml` for 64-hex literals
+(the `openssl rand -hex 32` shape all felhom bearer/API keys use), comments included; exit 1 on
+any hit. `felhom.secret.yaml`'s pre-existing committed secrets (umami APP_SECRET is 64-hex)
+print as a visible non-fatal KNOWN-BACKLOG line until that file's own de-git (secrets.md
+backlog). Run after ANY manifests/ change. Named "bearer" not "secret" — the repo `.gitignore`
+`*secret*` pattern silently un-tracks any "secret"-named file (learned the hard way: the gate's
+first landing never reached git). Red-proven: reintroducing a 64-hex literal → exit 1.
+
 ## felhom-host-install v1.15.0 — DR-tier-by-default: uniform DR plumbing on every install (2026-07-12)

 Sweeps the DRILL-day0-vm-2026-07-12 installer findings so the next Day-0 runs the drill's §5