cc-ci/docs/public-environment.md

Public runtime environment

.env.public contains non-sensitive configuration that the cc-ci orchestrator and its agent sessions need at runtime. It is intentionally tracked so it can be inspected and reproduced with the rest of the CI configuration.

Load it together with the local secret file by sourcing /srv/cc-ci/cc-ci-plan/load-env.sh. The helper reads .env.public first and then /srv/cc-ci/.testenv; credentials, tokens, and keys belong only in the latter file.

Do not put a value in .env.public merely because it is convenient. If it would grant access or require rotation, it is a secret and belongs in .testenv. Public service endpoints, model names, and account identifiers may be tracked here.