chore(security): broaden secret exclusions, move publish PAT out of the repo - #18
Open
jpantsjoha wants to merge 1 commit into
Open
chore(security): broaden secret exclusions, move publish PAT out of the repo#18jpantsjoha wants to merge 1 commit into
jpantsjoha wants to merge 1 commit into
Conversation
…ut of the repo A `.env` holding VSCODE_PUBLISH_PAT was sitting in the project directory. Verified it was never committed on any branch and was already ignored — but this repository is public, and a repo-local credential is one `git add -A` from being in it. The token now lives in the macOS keychain (`vsce-publish-pat`) with a mode-600 fallback at ~/.config/vscode-publishing/publish.env. The project copy is gone. Ignore rules widened from three literal .env variants to `.env.*`, `*.pat`, `*.token`, `secrets.json` and `.npmrc`, with `.env.example` still permitted so a template can be committed. Each pattern verified with `git check-ignore`. Publishing procedure now lives in a global skill rather than this repo, so it applies to every extension: ~/.claude/skills/vscode-extension-publisher.
jpantsjoha
force-pushed
the
chore/secret-hygiene
branch
2 times, most recently
from
August 7, 2026 15:06
2219bd1 to
f07ecf0
Compare
|
✅ All checks passed! Ready for review. |
1 similar comment
|
✅ All checks passed! Ready for review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A
.envholdingVSCODE_PUBLISH_PATwas in the project directory.Verified never committed on any branch, and already gitignored — but this repo is public, and a repo-local credential is one
git add -Aaway from being in it.vsce-publish-pat), mode-600 fallback at~/.config/vscode-publishing/publish.env. Project copy deleted..env.*,*.pat,*.token,secrets.json,.npmrc— with.env.examplestill allowed. Every pattern verified withgit check-ignore.No code change;
.gitignoreonly.