fix(detect): let .env.example-style templates through Stage 2 - #2232
Closed
SyedFahad7 wants to merge 1 commit into
Closed
fix(detect): let .env.example-style templates through Stage 2#2232SyedFahad7 wants to merge 1 commit into
SyedFahad7 wants to merge 1 commit into
Conversation
…ge 2 Stage 2's .env regex treated .env.example / .sample / .template / .dist like live secret files and dropped them from the graph. Carve out those suffixes for .env / .envrc basenames only — real .env.local etc. stay blocked. Fixes Graphify-Labs#2184
There was a problem hiding this comment.
Pull request overview
This PR updates Graphify’s file-sensitivity detection (Stage 2) to stop treating committed dotenv/envrc template files (e.g., .env.example, .env.sample, .env.template, .env.dist) as sensitive, so they can be included in indexing rather than being dropped as secrets.
Changes:
- Add
_ENV_TEMPLATE_SUFFIXESand_is_env_template()to identify committed.env/.envrctemplate naming patterns. - Update
_is_sensitive()Stage 2 to exempt these template filenames from_SENSITIVE_PATTERNSmatches.
Comments suppressed due to low confidence (1)
graphify/detect.py:278
- Add tests covering the new behavior:
.env.example/.env.sample/.envrc.templateshould not be reported underskipped_sensitive(and, once classified, should appear inresult["files"]["document"]), while.env,.env.local,.env.productionremain skipped as sensitive. Current tests assert.envstays excluded but don’t exercise the new template exemption.
# Stage 2: filename pattern match. Template suffixes (.example/.sample/…)
# on .env / .envrc are the usual "safe to commit" convention — keep them
# in the graph without opening a broad Stage 2 allowlist (#2184 / #1921).
name = path.name
if any(p.search(name) for p in _SENSITIVE_PATTERNS) and not _is_env_template(name):
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+274
to
+278
| # Stage 2: filename pattern match. Template suffixes (.example/.sample/…) | ||
| # on .env / .envrc are the usual "safe to commit" convention — keep them | ||
| # in the graph without opening a broad Stage 2 allowlist (#2184 / #1921). | ||
| name = path.name | ||
| if any(p.search(name) for p in _SENSITIVE_PATTERNS): | ||
| if any(p.search(name) for p in _SENSITIVE_PATTERNS) and not _is_env_template(name): |
safishamsi
added a commit
that referenced
this pull request
Jul 28, 2026
….example regression test (#2205, #2184) Follow-ups on the cherry-picked #2242/#2232: an all-dots label ('...') no longer produces an empty 'dot-' Obsidian stem (falls back to 'unnamed'), and the .env.example carve-out gets the regression test it shipped without (templates graphable, real .env still sensitive, secrets/.env.example still dropped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator
|
Thanks @SyedFahad7. Shipped in v0.9.29 (cherry-picked to v8), with the regression test added as a follow-up. Closed-unmerged here, but it's in the release: https://github.com/Graphify-Labs/graphify/releases/tag/v0.9.29 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2184.
Stage 2's
.env/.envrcregex also matched.env.example(and.sample/.template/.dist), so committed dotenv templates got dumped intoskipped_sensitiveand never made it into the graph. Real files like.env.localshould still be blocked — just not the usual placeholder naming.Carve-out is suffix + basename only; doesn't reopen a broad Stage 2 allowlist (#1921).
Test plan
.env.example/.env.sampleare indexed (not inskipped_sensitive).env,.env.local,.env.productionstill skippeduv run pytest tests/test_detect.py -q -k sensitive