mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 21:01:31 +00:00
shankar0123
5c7c125d9d
Commit 294f6cf (the prior docs fix for the multi-profile env vars)
introduced two doc-only env-var literals that the G-3 scanner picked
up as unmapped:
* CERTCTL_SCEP_PROFILE_CORP_ISSUER_ID — the literal CORP example
placeholder I added to clarify what the <NAME> substitution looks
like in practice. The G-3 scanner can't tell a placeholder from a
real env var.
* CERTCTL_SCEP_ — comes from the docs string CERTCTL_SCEP_* (the
asterisk is not in [A-Z_], so the regex strips it down to the
prefix and treats it as a phantom env var).
Two-part fix:
docs/features.md
* Replaced the literal CORP example (CERTCTL_SCEP_PROFILE_CORP_ISSUER_ID)
with a prose explanation that doesn't include a literal
placeholder env var name. Operators still get a clear example via
'a CERTCTL_SCEP_PROFILES entry of corp resolves the issuer-id env
var key with <NAME> replaced by CORP'.
.github/workflows/ci.yml
* Added CERTCTL_SCEP_ to the G-3 ALLOWED prefix list, mirroring the
existing CERTCTL_TLS_ entry. Both are legitimate doc-only prefix
references (CERTCTL_TLS_* / CERTCTL_SCEP_*) that the scanner sees
as bare prefixes after stripping the wildcard. The allowlist
documents these as integration-surface contracts that the
structured per-profile env vars expand into at runtime.
Verification: local G-3 set difference (Go-defined ∖ docs-mentioned)
empty in BOTH directions after the fix:
* DOCS_ONLY (docs ∖ Go, post-allowlist): empty
* CONFIG_ONLY (Go ∖ docs): empty
Restores green CI on the env-var docs drift guard.