Add pre-commit guard against ETHERPAD_DOMAIN leaks

[narthur]

Summary

• New scripts/check-no-etherpad-domain.sh fails the commit if ETHERPAD_DOMAIN is unset (and absent from .env), or if its literal value appears anywhere in the staged index.
• Wired into .husky/pre-commit after lint-staged.

Test plan

• Manual: unset env + no .env → commit blocked with explanatory message
• Manual: value set, no offending file → commit proceeds
• Manual: value set, offending file staged → commit blocked, offending file:line printed
• Manual: value loaded from .env and present in tree → commit blocked
• CI green

🤖 Generated with Claude Code

[github-actions]

Build Performance

⚡ +0.08s (+1.3%) average build time

	Base (3db5873)	Head (11aeedb)
Average	6.05s	6.13s
Runs	5.95,6.11,6.10	6.24,6.05,6.10

3 timed builds after one warm-up build per commit.

[Copilot]

Pull request overview

Adds a pre-commit guard that refuses to commit if the production Etherpad domain (read from the ETHERPAD_DOMAIN env var, falling back to a parsed .env) appears anywhere in the staged index. Wires the new script into the existing Husky pre-commit hook after lint-staged.

Changes:

• New scripts/check-no-etherpad-domain.sh that resolves ETHERPAD_DOMAIN (env → .env), aborts if unset, and uses git grep --cached -F to block commits containing the literal value (excluding .env* and the script itself).
• Updates .husky/pre-commit to invoke the new script after lint-staged.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 3 comments.

File	Description
scripts/check-no-etherpad-domain.sh	New bash guard: parses ETHERPAD_DOMAIN from env/.env, then git grep --cached -F against staged content to block commits leaking the value.
.husky/pre-commit	Adds invocation of the new guard script after pnpm exec lint-staged.

Comments suppressed due to low confidence (1)

scripts/check-no-etherpad-domain.sh:22

• If ETHERPAD_DOMAIN is set to a very short or common string (in .env or the environment), git grep -F will produce many false-positive matches and block all commits. There is no minimum-length sanity check on the value. Consider validating that the value is plausibly a domain (e.g. contains a dot and is at least a few characters) before running the search.

if [ -z "${ETHERPAD_DOMAIN:-}" ]; then
  echo "pre-commit: ETHERPAD_DOMAIN is unset and not found in .env." >&2
  echo "Set it (e.g. in .env) so this hook can verify no staged file contains the value." >&2
  exit 1
fi

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Accessibility Issues

Summary

No baseline issues found.

Baseline	Head
-	0

Issue Breakdown

Code

Count

View full breakdown