diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-06-10 13:27:43 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-06-10 13:27:43 +0900 |
| commit | 0443c8c9972cbe792716cca193f7ad1ae64c0eda (patch) | |
| tree | 1a337aa33bb0fa1bd3bc209c87302ed799a6dbdb /official-site/enrich-event.py | |
| parent | 4093468dc7117a2d796b9a18829d0058f742c334 (diff) | |
Remove hardcoded credentials: use env vars for AppSync/S3
All secrets (APP_SYNC_ENDPOINT, APP_SYNC_API_KEY, S3_BUCKET) moved to .env.
Scripts now fail-fast with :? if env vars are not set.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'official-site/enrich-event.py')
| -rwxr-xr-x | official-site/enrich-event.py | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/official-site/enrich-event.py b/official-site/enrich-event.py index 5350b41..846a61e 100755 --- a/official-site/enrich-event.py +++ b/official-site/enrich-event.py @@ -31,9 +31,17 @@ from pathlib import Path REPO_ROOT = Path(__file__).parent.parent ENV_FILE = REPO_ROOT / ".env" -APPSYNC_ENDPOINT = "https://APP_SYNC_ENDPOINT_REDACTED/graphql" -APPSYNC_KEY = "APP_SYNC_API_KEY_REDACTED" -S3_BUCKET = "S3_BUCKET_REDACTED" +# Load .env early so os.environ is populated before constants are evaluated +if ENV_FILE.exists(): + for _line in ENV_FILE.read_text().splitlines(): + _line = _line.strip() + if _line and not _line.startswith("#") and "=" in _line: + _k, _, _v = _line.partition("=") + os.environ.setdefault(_k.strip(), _v.strip()) + +APPSYNC_ENDPOINT = os.environ["APP_SYNC_ENDPOINT"] +APPSYNC_KEY = os.environ["APP_SYNC_API_KEY"] +S3_BUCKET = os.environ["S3_BUCKET"] S3_REGION = "ap-northeast-1" S3_PREFIX = "public/site/live" AWS_CLI = os.environ.get("AWS_CLI", "/tmp/awscli/aws/dist/aws") |