From 33ed39c32e5bfda2570f61c03af77ef1fb0b694f Mon Sep 17 00:00:00 2001 From: 128Na Date: Wed, 26 Aug 2026 00:24:42 +0900 Subject: [PATCH 1/3] fix: stop leaving .env.bak plaintext secrets on every deploy sed -i ".bak" on BSD sed creates a backup file containing the full .env (including all secrets) on every single deploy, and nothing ever cleaned it up. Found repeatedly during the credential rotation following the sakura.ad.jp incident (chore/records/2026-08-25). Switching to an empty backup suffix (sed -i "") makes BSD sed edit in place without creating a backup file at all. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 76e5bca..8bd5a3b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -70,7 +70,7 @@ jobs: cd ${{ secrets.APP_DIR }} && git fetch -p && git checkout ${{ github.ref }} - && bash -c 'sed -i ".bak" "s/APP_VERSION=.*/APP_VERSION=$( git describe --tags --abbrev=0 )/" .env' + && bash -c 'sed -i "" "s/APP_VERSION=.*/APP_VERSION=$( git describe --tags --abbrev=0 )/" .env' && php -c ~/www/php.ini ~/bin/composer.phar install --optimize-autoloader --no-dev && php -c ~/www/php.ini artisan migrate --force && php -c ~/www/php.ini artisan migrate:status From f2e5c14d9c1df709550c2c84b5b64c15788e5487 Mon Sep 17 00:00:00 2001 From: 128Na Date: Wed, 26 Aug 2026 00:33:31 +0900 Subject: [PATCH 2/3] fix: avoid ambiguous empty-quote sed arg, delete backup explicitly instead Code review flagged that changing the backup suffix to "" (an empty double-quote pair sitting inside already deeply nested ssh/bash -c/sed quoting) is hard to verify by inspection and risky for future edits. Revert to the previously-proven ".bak" quoting structure (confirmed working via .env.bak actually being created on the server) and just delete the backup file explicitly afterward. Same end result (no leftover .env.bak), but the intent is now a plain rm -f instead of relying on BSD sed's empty-suffix semantics threaded through triple quoting. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 8bd5a3b..97456f3 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -70,7 +70,7 @@ jobs: cd ${{ secrets.APP_DIR }} && git fetch -p && git checkout ${{ github.ref }} - && bash -c 'sed -i "" "s/APP_VERSION=.*/APP_VERSION=$( git describe --tags --abbrev=0 )/" .env' + && bash -c 'sed -i ".bak" "s/APP_VERSION=.*/APP_VERSION=$( git describe --tags --abbrev=0 )/" .env && rm -f .env.bak' && php -c ~/www/php.ini ~/bin/composer.phar install --optimize-autoloader --no-dev && php -c ~/www/php.ini artisan migrate --force && php -c ~/www/php.ini artisan migrate:status From cdafedc49b7f87e2ab08625d32515c6bad30ca98 Mon Sep 17 00:00:00 2001 From: 128Na Date: Wed, 26 Aug 2026 00:38:23 +0900 Subject: [PATCH 3/3] fix: make factory-generated urls unique to stop flaky UniqueConstraintViolationException RawPageFactory and PageFactory both used faker->url() without unique(), but raw_pages.url and pages.url both have DB-level unique constraints (raw_pages_url_unique, pages_url_unique). Tests that create multiple Page/RawPage records in one test (e.g. SearchActionTest) occasionally collide on the same faker-generated URL and fail with UniqueConstraintViolationException, unrelated to any application code. Unrelated to this PR's original change, but needed to get CI green here since it surfaced on this PR's run. Co-Authored-By: Claude Sonnet 5 --- database/factories/PageFactory.php | 2 +- database/factories/RawPageFactory.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/database/factories/PageFactory.php b/database/factories/PageFactory.php index d279062..dc8994e 100644 --- a/database/factories/PageFactory.php +++ b/database/factories/PageFactory.php @@ -21,7 +21,7 @@ public function definition(): array return [ 'raw_page_id' => RawPage::factory(), 'site_name' => $this->faker->randomElement(SiteName::cases()), - 'url' => $this->faker->url(), + 'url' => $this->faker->unique()->url(), 'title' => $this->faker->sentence(), 'text' => $this->faker->paragraph(), 'last_modified' => now(), diff --git a/database/factories/RawPageFactory.php b/database/factories/RawPageFactory.php index f53dca2..25583be 100644 --- a/database/factories/RawPageFactory.php +++ b/database/factories/RawPageFactory.php @@ -19,7 +19,7 @@ public function definition(): array { return [ 'site_name' => $this->faker->randomElement(SiteName::cases()), - 'url' => $this->faker->url(), + 'url' => $this->faker->unique()->url(), 'html' => 'Example HTML', ]; }