Found in review of #85, which added .git/modules/**/config to the canonical .dockerignore. Two cases are still wrong:
A submodule whose path has a config segment (config, deploy/config): the pattern also matches the directory .git/modules/deploy/config/, so that submodule's whole git directory stays out of the build context. Go's version stamping then fails the build ("not a git repository"). Loud, no leak.
A submodule with its own .git directory instead of one under .git/modules/ (for example one added from a repository already in the tree): sub/.git/config reaches the image, credential included. This predates PR 85.
Fix
Work out, against .dockerignore's own matching rules (explained at the top of the file), patterns that keep out every git config file in both cases without excluding a directory git or Go's version stamping needs. Prefer the plainest patterns that hold; a long list of re-includes is not acceptable. If case 1 cannot be closed plainly, record it in the file as a KNOWN GAP: comment, as the file already does for other gaps, saying what fails and that it fails loudly. Make prompts/REPO_POLICIES.md and both checklists agree (git grep -n -e '\.git/config' -e '\.git/modules' -- prompts/).
Definition of done
Verified by enumerating a scratch image, not by reading the file: a repository with a submodule at deploy/config and a submodule that keeps its own .git directory, a stand-in credential in every config. No credential reaches the image; git describe --tags --always and Go's version stamping work in the build, or the remaining case is recorded as a KNOWN GAP:. One line per check in the PR, no logs.
make check passes.
Model: opus-5-5
Found in review of https://git.eeqj.de/sneak/prompts/pulls/85, which added `.git/modules/**/config` to the canonical `.dockerignore`. Two cases are still wrong:
1. **A submodule whose path has a `config` segment** (`config`, `deploy/config`): the pattern also matches the directory `.git/modules/deploy/config/`, so that submodule's whole git directory stays out of the build context. Go's version stamping then fails the build ("not a git repository"). Loud, no leak.
2. **A submodule with its own `.git` directory** instead of one under `.git/modules/` (for example one added from a repository already in the tree): `sub/.git/config` reaches the image, credential included. This predates PR 85.
## Fix
Work out, against `.dockerignore`'s own matching rules (explained at the top of the file), patterns that keep out every git `config` file in both cases without excluding a directory git or Go's version stamping needs. Prefer the plainest patterns that hold; a long list of re-includes is not acceptable. If case 1 cannot be closed plainly, record it in the file as a `KNOWN GAP:` comment, as the file already does for other gaps, saying what fails and that it fails loudly. Make `prompts/REPO_POLICIES.md` and both checklists agree (`git grep -n -e '\.git/config' -e '\.git/modules' -- prompts/`).
## Definition of done
- Verified by enumerating a scratch image, not by reading the file: a repository with a submodule at `deploy/config` and a submodule that keeps its own `.git` directory, a stand-in credential in every config. No credential reaches the image; `git describe --tags --always` and Go's version stamping work in the build, or the remaining case is recorded as a `KNOWN GAP:`. One line per check in the PR, no logs.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-10-04 05:33:07 +02:00
Built in #96. A submodule that keeps its own .git directory no longer ships its config. A submodule named config or deploy/config is recorded in the file as a KNOWN GAP:, with the fix of naming it differently, because closing it plainly is not possible and the re-include it would take slows every build.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/prompts/pulls/96. A submodule that keeps its own `.git` directory no longer ships its config. A submodule named `config` or `deploy/config` is recorded in the file as a `KNOWN GAP:`, with the fix of naming it differently, because closing it plainly is not possible and the re-include it would take slows every build.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found in review of #85, which added
.git/modules/**/configto the canonical.dockerignore. Two cases are still wrong:configsegment (config,deploy/config): the pattern also matches the directory.git/modules/deploy/config/, so that submodule's whole git directory stays out of the build context. Go's version stamping then fails the build ("not a git repository"). Loud, no leak..gitdirectory instead of one under.git/modules/(for example one added from a repository already in the tree):sub/.git/configreaches the image, credential included. This predates PR 85.Fix
Work out, against
.dockerignore's own matching rules (explained at the top of the file), patterns that keep out every gitconfigfile in both cases without excluding a directory git or Go's version stamping needs. Prefer the plainest patterns that hold; a long list of re-includes is not acceptable. If case 1 cannot be closed plainly, record it in the file as aKNOWN GAP:comment, as the file already does for other gaps, saying what fails and that it fails loudly. Makeprompts/REPO_POLICIES.mdand both checklists agree (git grep -n -e '\.git/config' -e '\.git/modules' -- prompts/).Definition of done
deploy/configand a submodule that keeps its own.gitdirectory, a stand-in credential in every config. No credential reaches the image;git describe --tags --alwaysand Go's version stamping work in the build, or the remaining case is recorded as aKNOWN GAP:. One line per check in the PR, no logs.make checkpasses.Model: opus-5-5
Built in #96. A submodule that keeps its own
.gitdirectory no longer ships its config. A submodule namedconfigordeploy/configis recorded in the file as aKNOWN GAP:, with the fix of naming it differently, because closing it plainly is not possible and the re-include it would take slows every build.Model: opus-5-5