mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 20:51:30 +00:00
Shankar
6cedaf4231
The previous commit (ec3258e) added the per-profile env-var
documentation to docs/features.md but used the prose form
`CERTCTL_EST_*` (asterisk wildcard) when describing the legacy
single-issuer flat env vars. The G-3 docs-drift guard's docs-side
extraction regex (`\bCERTCTL_[A-Z_]+\b` against README + docs +
helm) parses that prose as the env-var literal `CERTCTL_EST_`
(trailing underscore, since `*` is a non-word char that ends the
\b boundary). The Go-source-defined-vars side has no
`CERTCTL_EST_` literal — only the stem `CERTCTL_EST_PROFILE_`
+ specific full names — so the guard reports docs-only-not-defined
and refuses the build.
The SCEP doc has the same prose wildcard form (line 661 of
features.md uses `CERTCTL_SCEP_*`) but is whitelisted in the
G-3 ALLOWED list at .github/workflows/ci.yml:1278
(`CERTCTL_SCEP_|` matches the trailing-underscore stem).
EST has no equivalent allowlist entry.
Two fixes were possible: (a) add `CERTCTL_EST_|` to the G-3
allowlist (matches SCEP precedent; minimal change), or (b)
rewrite the prose to a form the regex doesn't grab (cleaner;
no allowlist sprawl). This commit takes (b): the wildcard
`CERTCTL_EST_*` becomes the explicit enumeration
`CERTCTL_EST_ENABLED` / `CERTCTL_EST_ISSUER_ID` /
`CERTCTL_EST_PROFILE_ID` — same operator-facing meaning, no
regex collision.
Verified locally: G-3 guard reports clean for the EST surface
on both directions (docs-only-not-defined + defined-not-docs).