fix(supply-chain): exclude Docker build-context secrets

[seonghobae]

Closes #294.

Exact TDD lineage

This Draft started from protected main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 and owns only .dockerignore plus src/dockerBuildContextSecurity.test.ts.

Test-only head 8ba8711dedcc2d85ee8fca451f53fd1fa16783a9 produced qualifying hosted RED in CI 31653842186, build job 94303775209: exact-head checkout, immutable install, and typecheck completed before the new contract failed exactly because protected .dockerignore@7181b19c91919c189498bf5c7b4db9ff11c32866 did not exclude .env or private-key material. Browser and Office lanes remained green. Security Scan 31653842335 succeeded. SAST 31653842248 also identified a valid dynamic-RegExp defect in the first test helper; that finding was fixed rather than suppressed.

Current narrow repair

Current exact head is 6e3d1722b5e44470d6b249cb4b1cbad8578f1396 against live base main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03.

The build context now recursively excludes local .env*, npm/pnpm/yarn/netrc credential files, and common PEM/KEY/PKCS#12 credential containers, with an ordered negation that keeps deliberate .env.example files available. The contract uses deterministic wildcard matching rather than runtime-generated regular expressions and proves required package, lock, source, style, and demo inputs remain in context. Inkspan's standalone build remains credential-free; no Docker ARG/ENV secret, secret mount, network requirement, database, model, or host-owned deployment authority was introduced.

Exact-head proof

For unchanged head 6e3d1722b5e44470d6b249cb4b1cbad8578f1396:

• CI 31654551840: success. Exact checkout, immutable install, typecheck, 144 test files / 830 tests, and exact 100% owned-production statement/branch/function/line coverage passed.
• Library/package verification, exact packed consumers, demo build, and Chromium/Firefox/WebKit evidence passed.
• Office Python 3.11, 3.12, 3.13, and 3.14 passed with 100% branch and docstring gates.
• Security Scan 31654551829: success.
• SAST Semgrep 31654551844: success. The predecessor dynamic-RegExp thread is resolved and outdated on the current source.
• Formal approving reviews: 0. Valid unresolved review threads: 0.
• GitHub reports the Draft mergeable, but no predecessor evidence is transferred and it is intentionally not merged.

Integration boundary

Keep Draft/unmerged while #118 owns exact v0.6.0 publication from unchanged protected main. This next-release supply-chain repair is not represented as protected-main behavior or shipped release evidence.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ec41ddde-a51a-4dc4-b241-58bc77f40077

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}