Rename env/static.env → env/default.env across the entire repo
(string label, doc links, Python file-path constants) — the
`parse_static_env*` function names stay as a stable API surface.
Sort all `*.env` / `*.env.j2` entries alphabetically (52 in
default.env, 4 in ci.env, 46 of 49 j2 templates; 3 templates
with Jinja2 `{% %}` control flow are skipped because conditional
blocks would tear apart under a naive sort). Sort all 83
Makefile target blocks alphabetically; .PHONY group headers
stay in place.
Collapse the two remaining multi-line Makefile recipe comments
(dotenv-force, test-signed) to single-line WHY comments.
Add four lint tests under tests/lint/filesystem/ to keep the
invariants enforced going forward:
- env/test_alphabetical_sort.py
- env/test_single_line_comments.py (# nocheck: markers exempt)
- makefile/test_alphabetical_targets.py
- makefile/test_single_line_comments.py (# nocheck: markers exempt)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace the verbose
`(lookup('applications', application_id).server.domains.canonical | first)`
chain with the dedicated `lookup('domain', application_id)` plugin
across every playwright.env.j2 that renders `CANONICAL_DOMAIN`. The
helper already exists at plugins/lookup/domain.py and resolves the
canonical primary domain via the cached domain-merge pipeline, so the
inline canonical-list traversal is unnecessary noise that obscures
the actual contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds tests/lint/repository/test_literal_protocol_with_lookup.py which
fails when a file hand-writes the protocol next to a lookup-derived
domain. The protocol must come from the same source as the domain so
TLS-on / TLS-off / self-signed / public-CA stays consistent across the
stack; the `tls` lookup plugin emits both at once via the
`url.base` / `protocols.web` / `protocols.websocket` keys.
Mechanics
- Three regex patterns cover the realistic shapes:
1. `https?://{{ ... lookup( ... }}` (Jinja interpolation)
2. `"https?://" ~ lookup(...)` (Jinja concat with lookup)
3. `"https?://" ~ ... canonical.<key>` (concat with canonical access)
- Internal docker-network upstreams that are genuinely plaintext
(`http://<container>:<port>`) are not detected because the regex
requires a `lookup(` or `canonical.` token; they would only need
the noqa marker if the upstream resolution itself uses one of those.
- Per-line opt-out: `# noqa: literal-protocol-lookup` (or `nocheck`).
- File reads route through `utils.cache.files.read_text` and the
per-file scan result is cached process-wide via `lru_cache`.
Repo cleanup
- web-app-discourse and web-app-littlejs CSP entries now use
`lookup('tls', '<role>', 'url.base')` instead of pinning `http://` /
`https://` next to `lookup('domain', ...)`.
- web-app-matrix and web-svc-cdn Playwright env templates compose the
base URL through the `tls` lookup so the test runner uses the same
protocol the live stack serves.
- web-app-oauth2-proxy carries a single `# noqa: literal-protocol-lookup`
on the upstream line; that one is intentionally plaintext because
oauth2-proxy talks to its sibling upstream over the internal docker
network with no TLS.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Covers CSP header enforcement, canonical-domain surfacing, and landing
reachability. Passes against a reuse-kept deploy.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 4.7