From 0443c8c9972cbe792716cca193f7ad1ae64c0eda Mon Sep 17 00:00:00 2001 From: yyamashita Date: Wed, 10 Jun 2026 13:27:43 +0900 Subject: Remove hardcoded credentials: use env vars for AppSync/S3 All secrets (APP_SYNC_ENDPOINT, APP_SYNC_API_KEY, S3_BUCKET) moved to .env. Scripts now fail-fast with :? if env vars are not set. Co-Authored-By: Claude Sonnet 4.6 --- official-site/add-event.sh | 4 ++-- official-site/enrich-event.py | 14 +++++++++++--- official-site/list-events.sh | 4 ++-- 3 files changed, 15 insertions(+), 7 deletions(-) (limited to 'official-site') diff --git a/official-site/add-event.sh b/official-site/add-event.sh index 52c2d95..109c2c8 100755 --- a/official-site/add-event.sh +++ b/official-site/add-event.sh @@ -7,8 +7,8 @@ set -euo pipefail REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)" [ -f "$REPO_ROOT/.env" ] && set -a && source "$REPO_ROOT/.env" && set +a -ENDPOINT="https://APP_SYNC_ENDPOINT_REDACTED/graphql" -API_KEY="${APP_SYNC_API_KEY:-APP_SYNC_API_KEY_REDACTED}" +ENDPOINT="${APP_SYNC_ENDPOINT:?APP_SYNC_ENDPOINT not set}" +API_KEY="${APP_SYNC_API_KEY:?APP_SYNC_API_KEY not set}" JSON_FILE="${1:-}" if [ -z "$JSON_FILE" ]; then diff --git a/official-site/enrich-event.py b/official-site/enrich-event.py index 5350b41..846a61e 100755 --- a/official-site/enrich-event.py +++ b/official-site/enrich-event.py @@ -31,9 +31,17 @@ from pathlib import Path REPO_ROOT = Path(__file__).parent.parent ENV_FILE = REPO_ROOT / ".env" -APPSYNC_ENDPOINT = "https://APP_SYNC_ENDPOINT_REDACTED/graphql" -APPSYNC_KEY = "APP_SYNC_API_KEY_REDACTED" -S3_BUCKET = "S3_BUCKET_REDACTED" +# Load .env early so os.environ is populated before constants are evaluated +if ENV_FILE.exists(): + for _line in ENV_FILE.read_text().splitlines(): + _line = _line.strip() + if _line and not _line.startswith("#") and "=" in _line: + _k, _, _v = _line.partition("=") + os.environ.setdefault(_k.strip(), _v.strip()) + +APPSYNC_ENDPOINT = os.environ["APP_SYNC_ENDPOINT"] +APPSYNC_KEY = os.environ["APP_SYNC_API_KEY"] +S3_BUCKET = os.environ["S3_BUCKET"] S3_REGION = "ap-northeast-1" S3_PREFIX = "public/site/live" AWS_CLI = os.environ.get("AWS_CLI", "/tmp/awscli/aws/dist/aws") diff --git a/official-site/list-events.sh b/official-site/list-events.sh index 0093875..d56aabf 100755 --- a/official-site/list-events.sh +++ b/official-site/list-events.sh @@ -5,8 +5,8 @@ REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)" [ -f "$REPO_ROOT/.env" ] && set -a && source "$REPO_ROOT/.env" && set +a AWS_CLI="${AWS_CLI:-/tmp/awscli/aws/dist/aws}" -ENDPOINT="https://APP_SYNC_ENDPOINT_REDACTED/graphql" -API_KEY="${APP_SYNC_API_KEY:-APP_SYNC_API_KEY_REDACTED}" +ENDPOINT="${APP_SYNC_ENDPOINT:?APP_SYNC_ENDPOINT not set}" +API_KEY="${APP_SYNC_API_KEY:?APP_SYNC_API_KEY not set}" QUERY='{ listEvents(limit: 200) { items { id type date title venueName published shortTitle ticketFee key } } }' -- cgit v1.2.3