Skip to content

chore: untrack appsettings.Development.json, keep its defaults as an example #591

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mforce merged 1 commit into from
Aug 24, 2026
Merged

chore: untrack appsettings.Development.json, keep its defaults as an example #591

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,12 @@ obj/
# with version.txt (see release-please-config.json's extra-files).
!web/.env.production
appsettings.Development.local.json
# Local API debug config. AGENTS.md: "Dev secrets live in user-secrets, not
# files" — but this file is also where a connection string most easily ends up
# by accident, and it was tracked, so a local edit rode along into every diff.
# Untracked now; appsettings.Development.example.json carries the shared,
# non-secret Serilog defaults that used to live here.
src/Cluckwork.Api/appsettings.Development.json

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Exclude the local config from Docker builds

When a developer retains or creates this newly ignored file with a connection-string credential—the exact accident this change is intended to contain—the documented Compose build still sends it because .dockerignore does not exclude it; Dockerfile then runs COPY . . followed by dotnet publish, whose Web SDK glob packages appsettings*.json. The credential therefore becomes readable from the locally built production image even though Git no longer reports the file, so add this path to .dockerignore as well.

AGENTS.md reference: AGENTS.md:L119-L120

Useful? React with 👍 / 👎.


# OS/editor noise
.DS_Store
Expand Down
1 change: 1 addition & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,7 @@ dotnet test Cluckwork.sln # 688 tests as of 2026-07; integratio

- `deploy/.env` is gitignored (real values). `deploy/.env.example` holds placeholders only.
- Local API debug config uses `dotnet user-secrets` (keyed by `UserSecretsId` in `Cluckwork.Api.csproj`).
- `src/Cluckwork.Api/appsettings.Development.json` is **gitignored**, not tracked. It was tracked once, and a local connection string edited into it rode along in an unrelated diff — the file is the path of least resistance for exactly the value user-secrets exists to hold. The shared, non-secret Serilog dev defaults live in `appsettings.Development.example.json`; copy it if you want them, and put anything with a credential in user-secrets.
- No hardcoded passwords/keys in source — GitGuardian scans PRs. Generate test credentials at runtime.

## Host-agnostic repo (deployment boundary)
Expand Down
0 ...luckwork.Api/appsettings.Development.json → ....Api/appsettings.Development.example.json
View file
Open in desktop
File renamed without changes.
Loading