fix: normalize line endings in docker-entrypoint.sh and update Docker…

[elifouts]

…file to handle script permissions

[Copilot]

Pull request overview

This PR aims to prevent Docker entrypoint execution issues caused by inconsistent line endings and ensure the backend container reliably runs the entrypoint script with correct permissions.

Changes:

• Add repository-wide line-ending rules via .gitattributes (LF for shell scripts, CRLF for PowerShell).
• Update backend Dockerfile to strip CRLF from docker-entrypoint.sh at build time and ensure it’s executable.
• Normalize docker-entrypoint.sh content (notably removing several explanatory comments).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
backend/docker-entrypoint.sh	Normalizes content; retains JWT secret generation logic but removes prior explanatory comments.
backend/Dockerfile	Adds build-step normalization (CRLF removal) and chmod for the entrypoint script.
.gitattributes	Enforces consistent line endings for script files across the repo.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The top-of-file comments explaining why a random JWT secret is not generated by default (to preserve dev sessions) and how to enable random secret generation were removed. This behavior is non-obvious and security-sensitive; please restore that documentation (or move it to a stable docs location) so future changes don’t accidentally alter the intended semantics.

Suggested change

	# JWT secret handling
	# -------------------
	# By default, we DO NOT generate a random DEVBITS_JWT_SECRET. When
	# DEVBITS_JWT_SECRET is unset, the backend falls back to a stable built‑in
	# development secret. This is intentional: it preserves dev sessions across
	# container restarts so that restarting the backend does not log out all
	# developers.
	#
	# If you want this entrypoint to generate a random secret at startup, set:
	#
	# DEVBITS_FORCE_RANDOM_JWT_SECRET=1
	#
	# When DEVBITS_FORCE_RANDOM_JWT_SECRET=1 and DEVBITS_JWT_SECRET is empty,
	# we generate a random value (using openssl if available, otherwise
	# /dev/urandom) and export it as DEVBITS_JWT_SECRET for this container.
	#
	# IMPORTANT:
	# - For production, you SHOULD explicitly set a strong DEVBITS_JWT_SECRET and
	# NOT rely on the built‑in development default or this random‑generation
	# helper.
	# - Changing how/when a random secret is generated can break expectations
	# about session persistence; please update this comment if you modify the
	# behavior below.

[Copilot]

The fallback secret generation uses an unquoted command substitution. Even though the output is expected to be hex, quoting avoids any risk of word-splitting/globbing and keeps shell style consistent with the openssl branch.

Suggested change

	export DEVBITS_JWT_SECRET=$(head -c 32 /dev/urandom | od -An -v -tx1 | tr -d ' \n')
	export DEVBITS_JWT_SECRET="$(head -c 32 /dev/urandom | od -An -v -tx1 | tr -d ' \n')"

[Copilot]

Now that .gitattributes enforces LF for *.sh, the Docker build-time CRLF stripping via sed is likely redundant and can hide repository normalization issues. Consider relying on git normalization (and renormalizing the repo if needed) and keeping this step to just setting executable permissions, unless you have a specific non-git build context to support.

Suggested change

	RUN sed -i 's/\r$//' ./docker-entrypoint.sh && chmod +x ./docker-entrypoint.sh
	RUN chmod +x ./docker-entrypoint.sh