Repository navigation
Match a Capitalized Secrets Directory in the Runtime-Secrets Check #3842
Description
Problem
The runtime-secrets check in spec/audit.py (from #3719, PR #3838) matches a secrets directory's name case-sensitively. A bare directory spelled with a capital, such as Secrets/, breaks the runtimesecrets.naming rule just as secrets/ does, yet no tracked signal naming it is reported. The tree loop's existing .secrets match is case-sensitive in the same way, so a .Secrets/ directory is not judged either.
Constructed case
.gitignore Secrets/
compose.yml secrets: s: file: ./Secrets/Db_Password
Expected: a runtime-secrets finding naming the bare directory. Actual: no finding.
Suggested direction
Match the folder name case-insensitively in the .gitignore reader, the reference patterns, and the tree loop, and report a capitalized spelling as drift from .secrets/.
Activity
ptr727 commentedon Nov 3, 2026
A related line form, from the local review of PR #3838: a
.gitignoreline with a character class in the folder segment, such as[Ss]ecrets/, makes git ignore a lowercasesecrets/.ignored_secrets_foldermatches only a segment that is exactlysecrets, so a tree holding only that.gitignorereports nothing. A case-insensitive match should cover this form too.Detect a Bare secrets/ Directory From the Tracked Files That Name It (#…
Fix Adjacent Docs and Review Tails in the Open Pull Request Instead o…