Skip to content

[Improvement]: .gitignore does not cover the .env*.local files the test setup writes secrets into #401

Description

@cancan101

Improvement description

.gitignore ignores /.env, but not the .env*.local files Symfony actually loads local values from:

# Test env
…
/var/
/.env

Setting up the core test environment writes .env.test.local, and that file holds real secrets — PIMCORE_ENCRYPTION_SECRET, PIMCORE_INSTANCE_IDENTIFIER and PIMCORE_PRODUCT_KEY. Because it is untracked rather than ignored, it sits in git status as an ordinary candidate for staging, and a single git add -A while preparing a contribution publishes it in a pull request. That is exactly how it happened to us.

The surrounding block already ignores everything else a test install generates (/config/*, /public/, /src/, /var/, /bin/console), so this looks like an oversight rather than a decision — Symfony's own recommended file carries /.env.local, /.env.local.php and /.env.*.local.

A second, smaller one: /translations/ appears in a checkout after the translation unit tests run. Its messages.*.yml files contain the fallback_to_YML_* fixture keys from tests/Unit/Translation/TranslatorTest.php, and nothing in the repository tracks that directory.

Additional information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    Affected capability

    None yet

    Platform Version

    None yet

    Galaxy

    None yet

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions