From dfc20ebaa57f5d6864204437238fc98d43c83da7 Mon Sep 17 00:00:00 2001 From: Elstonyth <124340021+elstonyth@users.noreply.github.com> Date: Thu, 30 Jul 2026 17:35:39 +0800 Subject: [PATCH] fix(deploy): keep the secret-placeholder token out of spec prose MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #300 added a comment that spelled the redacted-secret placeholder token literally. do-apply.ps1's final guard greps the WHOLE spec text — comments included — for that token and aborts, so the prose alone was enough to block every backend deploy: pwsh scripts/do-apply.ps1 backend -Validate -> Unresolved secret placeholder remains - aborting Reworded, and the comment now says why the token must never appear in prose. `pwsh scripts/do-apply.ps1 backend -Validate` passes again ("Validation OK"), with exactly the ten real placeholders left in the file. Co-Authored-By: Claude Opus 5 --- .do/backend.app.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.do/backend.app.yaml b/.do/backend.app.yaml index 4d9df241..151d70f3 100644 --- a/.do/backend.app.yaml +++ b/.do/backend.app.yaml @@ -199,7 +199,9 @@ envs: value: __SECRET__PRICECHARTING_API_TOKEN__ # Required by Inventory > "Add from PC Collection". NOT a secret: it is the # public 26-char PriceCharting user id (their docs publish an example one), so - # it is a plain value rather than a __SECRET__ placeholder. The token above + # it is a plain value rather than a redacted-secret placeholder (do-apply.ps1 + # scans the WHOLE spec, comments included, so the literal placeholder token + # must never appear in prose here). The token above # only AUTHENTICATES — it does NOT scope /api/offers to our account, so # without this key PriceCharting answers with EVERY user's offers and the # route refuses to run rather than import strangers' cards as our stock.