Conversation
.env is already listed in .gitignore and is documented as machine-local (ASC key id / issuer id for the xcode-cloud helper). It was committed by accident from a worktree branched before the ignore rule existed, and the rebases replayed the addition. Untrack it (the file stays on disk) so the ignore rule takes effect and it stops shipping to this public repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
.envholds the machine-local Xcode Cloud credentials (ASC_KEY_ID/ASC_ISSUER_ID) and is explicitly documented as "Gitignored, machine-local, never committed" — but it is tracked onmain(added in 12ec808 / a339a95, and again in several dependabot branches). This repo is public, so it has been shipping.Root cause: marshal's
_marshal_setup_worktreecopies the real.envinto each new worktree, and those worktrees were branched from commits that predate the.envline in.gitignore. A broadgit add .staged it once, and later rebases faithfully replayed the addition — an ignore rule cannot untrack an already-recorded file.Only the Key ID and Issuer ID leaked; the
AuthKey_*.p8private key was never committed, so these values alone cannot authenticate to App Store Connect. Still, they should not be in the repo.What
git rm --cached .env— untracks the file while leaving it on disk, so.gitignore:51finally takes effect (git check-ignore -v .envnow matches).Follow-up (not in this PR)
.env(build(deps): bump actions/checkout from 4 to 7 #189, build(deps): bump actions/upload-artifact from 4 to 7 #190, build(deps): bump gitleaks/gitleaks-action from dcedce43c6f43de0b836d1fe38946645c9c638dc to ff98106e4c7b2bc287b24eaf42907196329070c7 #192) have had it dropped from their commits, so none of them can re-add it.filter-repo/BFG + force-push, judged not worth it for a non-secret key id.