From 4176b48a7beef4914fc23056d370acd0ede9abba Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 31 Aug 2026 16:49:14 +0000 Subject: [PATCH] config: track public cc-ci runtime environment --- .env.public | 7 +++++++ docs/public-environment.md | 15 +++++++++++++++ 2 files changed, 22 insertions(+) create mode 100644 .env.public create mode 100644 docs/public-environment.md diff --git a/.env.public b/.env.public new file mode 100644 index 0000000..d71af6b --- /dev/null +++ b/.env.public @@ -0,0 +1,7 @@ +# Non-sensitive runtime configuration shared by the cc-ci orchestrator and agents. +# +# Keep credentials, tokens, and keys in /srv/cc-ci/.testenv. The orchestrator +# loads this file first via cc-ci-plan/load-env.sh. +GITEA_USERNAME=autonomic-bot +TINFOIL_MODEL=deepseek-v4-pro +TINFOIL_BASE_URL=https://inference.tinfoil.sh/v1 diff --git a/docs/public-environment.md b/docs/public-environment.md new file mode 100644 index 0000000..3ddcb51 --- /dev/null +++ b/docs/public-environment.md @@ -0,0 +1,15 @@ +# Public runtime environment + +`.env.public` contains non-sensitive configuration that the cc-ci orchestrator +and its agent sessions need at runtime. It is intentionally tracked so it can +be inspected and reproduced with the rest of the CI configuration. + +Load it together with the local secret file by sourcing +`/srv/cc-ci/cc-ci-plan/load-env.sh`. The helper reads `.env.public` first and +then `/srv/cc-ci/.testenv`; credentials, tokens, and keys belong only in the +latter file. + +Do not put a value in `.env.public` merely because it is convenient. If it +would grant access or require rotation, it is a secret and belongs in +`.testenv`. Public service endpoints, model names, and account identifiers may +be tracked here.