Remove hardcoded credentials: use env vars for AppSync/S3

All secrets (APP_SYNC_ENDPOINT, APP_SYNC_API_KEY, S3_BUCKET) moved to .env.
Scripts now fail-fast with :? if env vars are not set.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

4 files changed, 17 insertions, 9 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 13bf017..81782dc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -15,8 +15,8 @@ mosquitone バンドの各システムを管理するリポジトリ。
 
 #### バックエンド (AppSync / DynamoDB)
 
-- エンドポイント: `https://APP_SYNC_ENDPOINT_REDACTED/graphql`
-- API キー: `APP_SYNC_API_KEY_REDACTED`（`.env` の `APP_SYNC_API_KEY`）
+- エンドポイント: `.env` の `APP_SYNC_ENDPOINT`
+- API キー: `.env` の `APP_SYNC_API_KEY`
 
 #### 情報ソース
 
diff --git a/official-site/add-event.sh b/official-site/add-event.sh
index 52c2d95..109c2c8 100755
--- a/official-site/add-event.sh
+++ b/official-site/add-event.sh
@@ -7,8 +7,8 @@ set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 [ -f "$REPO_ROOT/.env" ] && set -a && source "$REPO_ROOT/.env" && set +a
 
-ENDPOINT="https://APP_SYNC_ENDPOINT_REDACTED/graphql"
-API_KEY="${APP_SYNC_API_KEY:-APP_SYNC_API_KEY_REDACTED}"
+ENDPOINT="${APP_SYNC_ENDPOINT:?APP_SYNC_ENDPOINT not set}"
+API_KEY="${APP_SYNC_API_KEY:?APP_SYNC_API_KEY not set}"
 
 JSON_FILE="${1:-}"
 if [ -z "$JSON_FILE" ]; then
diff --git a/official-site/enrich-event.py b/official-site/enrich-event.py
index 5350b41..846a61e 100755
--- a/official-site/enrich-event.py
+++ b/official-site/enrich-event.py
@@ -31,9 +31,17 @@ from pathlib import Path
 REPO_ROOT = Path(__file__).parent.parent
 ENV_FILE = REPO_ROOT / ".env"
 
-APPSYNC_ENDPOINT = "https://APP_SYNC_ENDPOINT_REDACTED/graphql"
-APPSYNC_KEY      = "APP_SYNC_API_KEY_REDACTED"
-S3_BUCKET        = "S3_BUCKET_REDACTED"
+# Load .env early so os.environ is populated before constants are evaluated
+if ENV_FILE.exists():
+    for _line in ENV_FILE.read_text().splitlines():
+        _line = _line.strip()
+        if _line and not _line.startswith("#") and "=" in _line:
+            _k, _, _v = _line.partition("=")
+            os.environ.setdefault(_k.strip(), _v.strip())
+
+APPSYNC_ENDPOINT = os.environ["APP_SYNC_ENDPOINT"]
+APPSYNC_KEY      = os.environ["APP_SYNC_API_KEY"]
+S3_BUCKET        = os.environ["S3_BUCKET"]
 S3_REGION        = "ap-northeast-1"
 S3_PREFIX        = "public/site/live"
 AWS_CLI          = os.environ.get("AWS_CLI", "/tmp/awscli/aws/dist/aws")
diff --git a/official-site/list-events.sh b/official-site/list-events.sh
index 0093875..d56aabf 100755
--- a/official-site/list-events.sh
+++ b/official-site/list-events.sh
@@ -5,8 +5,8 @@ REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 [ -f "$REPO_ROOT/.env" ] && set -a && source "$REPO_ROOT/.env" && set +a
 
 AWS_CLI="${AWS_CLI:-/tmp/awscli/aws/dist/aws}"
-ENDPOINT="https://APP_SYNC_ENDPOINT_REDACTED/graphql"
-API_KEY="${APP_SYNC_API_KEY:-APP_SYNC_API_KEY_REDACTED}"
+ENDPOINT="${APP_SYNC_ENDPOINT:?APP_SYNC_ENDPOINT not set}"
+API_KEY="${APP_SYNC_API_KEY:?APP_SYNC_API_KEY not set}"
 
 QUERY='{ listEvents(limit: 200) { items { id type date title venueName published shortTitle ticketFee key } } }'