envguard-bin 1.0.3__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- envguard_bin-1.0.3/PKG-INFO +196 -0
- envguard_bin-1.0.3/README.md +183 -0
- envguard_bin-1.0.3/envguard/__init__.py +2 -0
- envguard_bin-1.0.3/envguard/main.py +99 -0
- envguard_bin-1.0.3/envguard_bin.egg-info/PKG-INFO +196 -0
- envguard_bin-1.0.3/envguard_bin.egg-info/SOURCES.txt +9 -0
- envguard_bin-1.0.3/envguard_bin.egg-info/dependency_links.txt +1 -0
- envguard_bin-1.0.3/envguard_bin.egg-info/entry_points.txt +2 -0
- envguard_bin-1.0.3/envguard_bin.egg-info/top_level.txt +1 -0
- envguard_bin-1.0.3/pyproject.toml +25 -0
- envguard_bin-1.0.3/setup.cfg +4 -0
|
@@ -0,0 +1,196 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: envguard-bin
|
|
3
|
+
Version: 1.0.3
|
|
4
|
+
Summary: The ESLint for environment variables
|
|
5
|
+
Author: Vamshavardhan50
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/Vamshavardhan50/envguard
|
|
8
|
+
Classifier: Programming Language :: Python :: 3
|
|
9
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Requires-Python: >=3.7
|
|
12
|
+
Description-Content-Type: text/markdown
|
|
13
|
+
|
|
14
|
+
# envguard 🛡️
|
|
15
|
+
|
|
16
|
+
[](https://github.com/Vamshavardhan50/envguard/actions/workflows/ci.yml)
|
|
17
|
+
[](https://github.com/Vamshavardhan50/envguard/actions/workflows/release.yml)
|
|
18
|
+
[](https://opensource.org/licenses/MIT)
|
|
19
|
+
|
|
20
|
+
> **Think of `envguard` as a spell-checker/linter for your environment variables.**
|
|
21
|
+
> It scans your code, checks your `.env` files, and makes sure you never break your app in production due to a missing or misconfigured setting. It is fast, works 100% offline, and requires zero configuration to start.
|
|
22
|
+
|
|
23
|
+
---
|
|
24
|
+
|
|
25
|
+
## What is envguard?
|
|
26
|
+
Have you ever deployed an app, only for it to immediately crash because you forgot to copy a new API key to the server? Or because someone configured `PORT` as a word instead of a number?
|
|
27
|
+
|
|
28
|
+
`envguard` solves this by automatically finding all environment variables your code uses (like `process.env.DATABASE_URL` or `os.environ.get('PORT')`) and checking them against your `.env` configuration file. It warns you immediately about:
|
|
29
|
+
- ❌ **Missing variables** that your code expects but are not configured.
|
|
30
|
+
- ⚠️ **Unused variables** in `.env` that your code doesn't actually use.
|
|
31
|
+
- 🚫 **Invalid formats** (e.g. database URLs that are not valid URLs, or ports that are not numbers).
|
|
32
|
+
|
|
33
|
+
---
|
|
34
|
+
|
|
35
|
+
## ⚡ Quick 1-Minute Start
|
|
36
|
+
|
|
37
|
+
Get up and running in three simple steps:
|
|
38
|
+
|
|
39
|
+
### 1. Install it
|
|
40
|
+
Run the install command for your favorite package manager:
|
|
41
|
+
|
|
42
|
+
```bash
|
|
43
|
+
# Using Node (NPM)
|
|
44
|
+
npm install -g envguard-bin
|
|
45
|
+
|
|
46
|
+
# Using Python (PIP)
|
|
47
|
+
pip install envguard
|
|
48
|
+
|
|
49
|
+
# Using Go
|
|
50
|
+
go install github.com/Vamshavardhan50/envguard@latest
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
### 2. Set it up
|
|
54
|
+
Run the setup wizard in your project folder. It will scan your project, find your environment variables, and create a safe configuration file (`.envguard.yaml`) for you:
|
|
55
|
+
|
|
56
|
+
```bash
|
|
57
|
+
envguard init
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
### 3. Guard your project
|
|
61
|
+
Scan your project to find any discrepancies:
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
envguard audit
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## 🔒 Security & Privacy First
|
|
70
|
+
|
|
71
|
+
- **100% Offline:** `envguard` never makes network requests and never uploads anything.
|
|
72
|
+
- **Privacy-Engineered:** It only reads and displays the **names** of the keys (e.g. `STRIPE_API_KEY`). It **never** reads, logs, or prints the actual secret values.
|
|
73
|
+
|
|
74
|
+
---
|
|
75
|
+
|
|
76
|
+
## 🛠️ How to Use: Common Tasks
|
|
77
|
+
|
|
78
|
+
Here is how to run `envguard`'s most common commands in your project:
|
|
79
|
+
|
|
80
|
+
### 🔍 Find Missing or Unused Keys
|
|
81
|
+
To check if your local `.env` file matches what your code actually uses, run:
|
|
82
|
+
```bash
|
|
83
|
+
envguard audit
|
|
84
|
+
```
|
|
85
|
+
*Tip: In your CI/CD pipelines, run `envguard audit --ci` to automatically fail build pipelines if keys are missing.*
|
|
86
|
+
|
|
87
|
+
---
|
|
88
|
+
|
|
89
|
+
### 🛡️ Check If Values Are Correct (Validation)
|
|
90
|
+
You can define rules in `.envguard.yaml` (e.g., checking if `DATABASE_URL` is a valid URL, or `PORT` is a number). To validate your current configuration against these rules, run:
|
|
91
|
+
```bash
|
|
92
|
+
envguard validate
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
---
|
|
96
|
+
|
|
97
|
+
### 📝 Auto-Update Your `.env.example` Template
|
|
98
|
+
Stop updating `.env.example` templates manually! Run this command to automatically read your `.env` file and generate a clean `.env.example` containing only the keys (values are safely stripped):
|
|
99
|
+
```bash
|
|
100
|
+
envguard sync --force
|
|
101
|
+
```
|
|
102
|
+
|
|
103
|
+
---
|
|
104
|
+
|
|
105
|
+
### 🩺 Run a Project Health Check
|
|
106
|
+
To perform a structure audit of your environment file setup (making sure `.env` is inside `.gitignore` so you don't accidentally publish secrets, checking file integrity, etc.), run:
|
|
107
|
+
```bash
|
|
108
|
+
envguard doctor
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
---
|
|
112
|
+
|
|
113
|
+
## ⚙️ Advanced Configuration (`.envguard.yaml`)
|
|
114
|
+
|
|
115
|
+
You can customize how `envguard` behaves by editing your `.envguard.yaml` file. Here is an example:
|
|
116
|
+
|
|
117
|
+
```yaml
|
|
118
|
+
version: 1
|
|
119
|
+
|
|
120
|
+
scan:
|
|
121
|
+
paths:
|
|
122
|
+
- "."
|
|
123
|
+
ignore:
|
|
124
|
+
- "node_modules"
|
|
125
|
+
- ".git"
|
|
126
|
+
- "dist"
|
|
127
|
+
languages:
|
|
128
|
+
- auto # Auto-detects JavaScript, TypeScript, Python, Go, Rust, Ruby, Dockerfiles, etc.
|
|
129
|
+
|
|
130
|
+
# Define rules for validating values
|
|
131
|
+
rules:
|
|
132
|
+
DATABASE_URL:
|
|
133
|
+
required: true
|
|
134
|
+
type: url
|
|
135
|
+
description: "Primary PostgreSQL database URL"
|
|
136
|
+
PORT:
|
|
137
|
+
required: false
|
|
138
|
+
type: number
|
|
139
|
+
default: "3000"
|
|
140
|
+
description: "The port the web server runs on"
|
|
141
|
+
NODE_ENV:
|
|
142
|
+
required: true
|
|
143
|
+
type: enum
|
|
144
|
+
values:
|
|
145
|
+
- development
|
|
146
|
+
- production
|
|
147
|
+
- test
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
---
|
|
151
|
+
|
|
152
|
+
## 🤖 Integrate with GitHub Actions
|
|
153
|
+
|
|
154
|
+
Add `envguard` to your GitHub Actions workflow to block pull requests containing invalid or incomplete configurations:
|
|
155
|
+
|
|
156
|
+
```yaml
|
|
157
|
+
name: Guard Environment
|
|
158
|
+
|
|
159
|
+
on:
|
|
160
|
+
push:
|
|
161
|
+
branches: [main]
|
|
162
|
+
pull_request:
|
|
163
|
+
branches: [main]
|
|
164
|
+
|
|
165
|
+
jobs:
|
|
166
|
+
audit:
|
|
167
|
+
runs-on: ubuntu-latest
|
|
168
|
+
steps:
|
|
169
|
+
- uses: actions/checkout@v4
|
|
170
|
+
- name: Setup Go
|
|
171
|
+
uses: actions/setup-go@v5
|
|
172
|
+
with:
|
|
173
|
+
go-version: "1.22"
|
|
174
|
+
- name: Install envguard
|
|
175
|
+
run: go install github.com/Vamshavardhan50/envguard@latest
|
|
176
|
+
- name: Run audit
|
|
177
|
+
run: envguard audit --ci --format github
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
---
|
|
181
|
+
|
|
182
|
+
## 🙋 Frequently Asked Questions (FAQ)
|
|
183
|
+
|
|
184
|
+
### Does `envguard` send my secrets to a third-party server?
|
|
185
|
+
**No.** `envguard` runs entirely on your local machine. It does not send any telemetry, analytics, or credentials over the internet.
|
|
186
|
+
|
|
187
|
+
### What languages does the code scanner support?
|
|
188
|
+
`envguard` scans JavaScript (`process.env.VAR`), TypeScript, React/Vue (`import.meta.env.VAR` or `process.env.VAR`), Python (`os.environ`), Go (`os.Getenv`), Ruby, Rust, PHP, Java, Shell scripts, and Dockerfiles out-of-the-box.
|
|
189
|
+
|
|
190
|
+
### How is this different from other dotenv validators?
|
|
191
|
+
Unlike most tools, `envguard` does not just check if a `.env` file exists. It **statically scans your source code files** to find what keys your code actually references, highlighting code references that are completely missing from your config.
|
|
192
|
+
|
|
193
|
+
---
|
|
194
|
+
|
|
195
|
+
## 📄 License
|
|
196
|
+
This project is open-source software licensed under the [MIT License](LICENSE).
|
|
@@ -0,0 +1,183 @@
|
|
|
1
|
+
# envguard 🛡️
|
|
2
|
+
|
|
3
|
+
[](https://github.com/Vamshavardhan50/envguard/actions/workflows/ci.yml)
|
|
4
|
+
[](https://github.com/Vamshavardhan50/envguard/actions/workflows/release.yml)
|
|
5
|
+
[](https://opensource.org/licenses/MIT)
|
|
6
|
+
|
|
7
|
+
> **Think of `envguard` as a spell-checker/linter for your environment variables.**
|
|
8
|
+
> It scans your code, checks your `.env` files, and makes sure you never break your app in production due to a missing or misconfigured setting. It is fast, works 100% offline, and requires zero configuration to start.
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## What is envguard?
|
|
13
|
+
Have you ever deployed an app, only for it to immediately crash because you forgot to copy a new API key to the server? Or because someone configured `PORT` as a word instead of a number?
|
|
14
|
+
|
|
15
|
+
`envguard` solves this by automatically finding all environment variables your code uses (like `process.env.DATABASE_URL` or `os.environ.get('PORT')`) and checking them against your `.env` configuration file. It warns you immediately about:
|
|
16
|
+
- ❌ **Missing variables** that your code expects but are not configured.
|
|
17
|
+
- ⚠️ **Unused variables** in `.env` that your code doesn't actually use.
|
|
18
|
+
- 🚫 **Invalid formats** (e.g. database URLs that are not valid URLs, or ports that are not numbers).
|
|
19
|
+
|
|
20
|
+
---
|
|
21
|
+
|
|
22
|
+
## ⚡ Quick 1-Minute Start
|
|
23
|
+
|
|
24
|
+
Get up and running in three simple steps:
|
|
25
|
+
|
|
26
|
+
### 1. Install it
|
|
27
|
+
Run the install command for your favorite package manager:
|
|
28
|
+
|
|
29
|
+
```bash
|
|
30
|
+
# Using Node (NPM)
|
|
31
|
+
npm install -g envguard-bin
|
|
32
|
+
|
|
33
|
+
# Using Python (PIP)
|
|
34
|
+
pip install envguard
|
|
35
|
+
|
|
36
|
+
# Using Go
|
|
37
|
+
go install github.com/Vamshavardhan50/envguard@latest
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
### 2. Set it up
|
|
41
|
+
Run the setup wizard in your project folder. It will scan your project, find your environment variables, and create a safe configuration file (`.envguard.yaml`) for you:
|
|
42
|
+
|
|
43
|
+
```bash
|
|
44
|
+
envguard init
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
### 3. Guard your project
|
|
48
|
+
Scan your project to find any discrepancies:
|
|
49
|
+
|
|
50
|
+
```bash
|
|
51
|
+
envguard audit
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
---
|
|
55
|
+
|
|
56
|
+
## 🔒 Security & Privacy First
|
|
57
|
+
|
|
58
|
+
- **100% Offline:** `envguard` never makes network requests and never uploads anything.
|
|
59
|
+
- **Privacy-Engineered:** It only reads and displays the **names** of the keys (e.g. `STRIPE_API_KEY`). It **never** reads, logs, or prints the actual secret values.
|
|
60
|
+
|
|
61
|
+
---
|
|
62
|
+
|
|
63
|
+
## 🛠️ How to Use: Common Tasks
|
|
64
|
+
|
|
65
|
+
Here is how to run `envguard`'s most common commands in your project:
|
|
66
|
+
|
|
67
|
+
### 🔍 Find Missing or Unused Keys
|
|
68
|
+
To check if your local `.env` file matches what your code actually uses, run:
|
|
69
|
+
```bash
|
|
70
|
+
envguard audit
|
|
71
|
+
```
|
|
72
|
+
*Tip: In your CI/CD pipelines, run `envguard audit --ci` to automatically fail build pipelines if keys are missing.*
|
|
73
|
+
|
|
74
|
+
---
|
|
75
|
+
|
|
76
|
+
### 🛡️ Check If Values Are Correct (Validation)
|
|
77
|
+
You can define rules in `.envguard.yaml` (e.g., checking if `DATABASE_URL` is a valid URL, or `PORT` is a number). To validate your current configuration against these rules, run:
|
|
78
|
+
```bash
|
|
79
|
+
envguard validate
|
|
80
|
+
```
|
|
81
|
+
|
|
82
|
+
---
|
|
83
|
+
|
|
84
|
+
### 📝 Auto-Update Your `.env.example` Template
|
|
85
|
+
Stop updating `.env.example` templates manually! Run this command to automatically read your `.env` file and generate a clean `.env.example` containing only the keys (values are safely stripped):
|
|
86
|
+
```bash
|
|
87
|
+
envguard sync --force
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
---
|
|
91
|
+
|
|
92
|
+
### 🩺 Run a Project Health Check
|
|
93
|
+
To perform a structure audit of your environment file setup (making sure `.env` is inside `.gitignore` so you don't accidentally publish secrets, checking file integrity, etc.), run:
|
|
94
|
+
```bash
|
|
95
|
+
envguard doctor
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
---
|
|
99
|
+
|
|
100
|
+
## ⚙️ Advanced Configuration (`.envguard.yaml`)
|
|
101
|
+
|
|
102
|
+
You can customize how `envguard` behaves by editing your `.envguard.yaml` file. Here is an example:
|
|
103
|
+
|
|
104
|
+
```yaml
|
|
105
|
+
version: 1
|
|
106
|
+
|
|
107
|
+
scan:
|
|
108
|
+
paths:
|
|
109
|
+
- "."
|
|
110
|
+
ignore:
|
|
111
|
+
- "node_modules"
|
|
112
|
+
- ".git"
|
|
113
|
+
- "dist"
|
|
114
|
+
languages:
|
|
115
|
+
- auto # Auto-detects JavaScript, TypeScript, Python, Go, Rust, Ruby, Dockerfiles, etc.
|
|
116
|
+
|
|
117
|
+
# Define rules for validating values
|
|
118
|
+
rules:
|
|
119
|
+
DATABASE_URL:
|
|
120
|
+
required: true
|
|
121
|
+
type: url
|
|
122
|
+
description: "Primary PostgreSQL database URL"
|
|
123
|
+
PORT:
|
|
124
|
+
required: false
|
|
125
|
+
type: number
|
|
126
|
+
default: "3000"
|
|
127
|
+
description: "The port the web server runs on"
|
|
128
|
+
NODE_ENV:
|
|
129
|
+
required: true
|
|
130
|
+
type: enum
|
|
131
|
+
values:
|
|
132
|
+
- development
|
|
133
|
+
- production
|
|
134
|
+
- test
|
|
135
|
+
```
|
|
136
|
+
|
|
137
|
+
---
|
|
138
|
+
|
|
139
|
+
## 🤖 Integrate with GitHub Actions
|
|
140
|
+
|
|
141
|
+
Add `envguard` to your GitHub Actions workflow to block pull requests containing invalid or incomplete configurations:
|
|
142
|
+
|
|
143
|
+
```yaml
|
|
144
|
+
name: Guard Environment
|
|
145
|
+
|
|
146
|
+
on:
|
|
147
|
+
push:
|
|
148
|
+
branches: [main]
|
|
149
|
+
pull_request:
|
|
150
|
+
branches: [main]
|
|
151
|
+
|
|
152
|
+
jobs:
|
|
153
|
+
audit:
|
|
154
|
+
runs-on: ubuntu-latest
|
|
155
|
+
steps:
|
|
156
|
+
- uses: actions/checkout@v4
|
|
157
|
+
- name: Setup Go
|
|
158
|
+
uses: actions/setup-go@v5
|
|
159
|
+
with:
|
|
160
|
+
go-version: "1.22"
|
|
161
|
+
- name: Install envguard
|
|
162
|
+
run: go install github.com/Vamshavardhan50/envguard@latest
|
|
163
|
+
- name: Run audit
|
|
164
|
+
run: envguard audit --ci --format github
|
|
165
|
+
```
|
|
166
|
+
|
|
167
|
+
---
|
|
168
|
+
|
|
169
|
+
## 🙋 Frequently Asked Questions (FAQ)
|
|
170
|
+
|
|
171
|
+
### Does `envguard` send my secrets to a third-party server?
|
|
172
|
+
**No.** `envguard` runs entirely on your local machine. It does not send any telemetry, analytics, or credentials over the internet.
|
|
173
|
+
|
|
174
|
+
### What languages does the code scanner support?
|
|
175
|
+
`envguard` scans JavaScript (`process.env.VAR`), TypeScript, React/Vue (`import.meta.env.VAR` or `process.env.VAR`), Python (`os.environ`), Go (`os.Getenv`), Ruby, Rust, PHP, Java, Shell scripts, and Dockerfiles out-of-the-box.
|
|
176
|
+
|
|
177
|
+
### How is this different from other dotenv validators?
|
|
178
|
+
Unlike most tools, `envguard` does not just check if a `.env` file exists. It **statically scans your source code files** to find what keys your code actually references, highlighting code references that are completely missing from your config.
|
|
179
|
+
|
|
180
|
+
---
|
|
181
|
+
|
|
182
|
+
## 📄 License
|
|
183
|
+
This project is open-source software licensed under the [MIT License](LICENSE).
|
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
# distributions/pip/envguard/main.py
|
|
2
|
+
# Python wrapper for envguard that downloads the native binary on first run and executes it.
|
|
3
|
+
|
|
4
|
+
import os
|
|
5
|
+
import sys
|
|
6
|
+
import platform
|
|
7
|
+
import urllib.request
|
|
8
|
+
import tarfile
|
|
9
|
+
import zipfile
|
|
10
|
+
import subprocess
|
|
11
|
+
|
|
12
|
+
VERSION = "1.0.3"
|
|
13
|
+
OWNER = "Vamshavardhan50"
|
|
14
|
+
REPO = "envguard"
|
|
15
|
+
|
|
16
|
+
def get_platform_details():
|
|
17
|
+
system = platform.system().lower()
|
|
18
|
+
machine = platform.machine().lower()
|
|
19
|
+
|
|
20
|
+
if system == "darwin":
|
|
21
|
+
os_name = "darwin"
|
|
22
|
+
elif system == "linux":
|
|
23
|
+
os_name = "linux"
|
|
24
|
+
elif system == "windows":
|
|
25
|
+
os_name = "windows"
|
|
26
|
+
else:
|
|
27
|
+
raise OSError(f"Unsupported operating system: {system}")
|
|
28
|
+
|
|
29
|
+
if machine in ["amd64", "x86_64"]:
|
|
30
|
+
arch_name = "amd64"
|
|
31
|
+
elif machine in ["arm64", "aarch64"]:
|
|
32
|
+
arch_name = "arm64"
|
|
33
|
+
elif machine in ["386", "i386", "i686"]:
|
|
34
|
+
arch_name = "386"
|
|
35
|
+
else:
|
|
36
|
+
raise OSError(f"Unsupported architecture: {machine}")
|
|
37
|
+
|
|
38
|
+
# goreleaser ignores windows arm64 and darwin 386
|
|
39
|
+
if os_name == "windows" and arch_name == "arm64":
|
|
40
|
+
raise OSError("envguard binary is not built for Windows ARM64")
|
|
41
|
+
if os_name == "darwin" and arch_name == "386":
|
|
42
|
+
raise OSError("envguard binary is not built for macOS 386")
|
|
43
|
+
|
|
44
|
+
return os_name, arch_name
|
|
45
|
+
|
|
46
|
+
def download_binary(dest_dir, os_name, arch_name):
|
|
47
|
+
ext = "zip" if os_name == "windows" else "tar.gz"
|
|
48
|
+
archive_name = f"envguard_{os_name}_{arch_name}.{ext}"
|
|
49
|
+
url = f"https://github.com/{OWNER}/{REPO}/releases/download/v{VERSION}/{archive_name}"
|
|
50
|
+
archive_path = os.path.join(dest_dir, archive_name)
|
|
51
|
+
|
|
52
|
+
print(f"Downloading envguard v{VERSION} from {url}...")
|
|
53
|
+
try:
|
|
54
|
+
urllib.request.urlretrieve(url, archive_path)
|
|
55
|
+
except Exception as e:
|
|
56
|
+
print(f"Failed to download envguard release: {e}", file=sys.stderr)
|
|
57
|
+
raise
|
|
58
|
+
|
|
59
|
+
print("Extracting archive...")
|
|
60
|
+
try:
|
|
61
|
+
if ext == "zip":
|
|
62
|
+
with zipfile.ZipFile(archive_path, 'r') as zip_ref:
|
|
63
|
+
zip_ref.extractall(dest_dir)
|
|
64
|
+
else:
|
|
65
|
+
with tarfile.open(archive_path, 'r:gz') as tar_ref:
|
|
66
|
+
tar_ref.extractall(dest_dir)
|
|
67
|
+
except Exception as e:
|
|
68
|
+
print(f"Failed to extract envguard archive: {e}", file=sys.stderr)
|
|
69
|
+
raise
|
|
70
|
+
finally:
|
|
71
|
+
if os.path.exists(archive_path):
|
|
72
|
+
os.remove(archive_path)
|
|
73
|
+
|
|
74
|
+
binary_name = "envguard.exe" if os_name == "windows" else "envguard"
|
|
75
|
+
binary_path = os.path.join(dest_dir, binary_name)
|
|
76
|
+
if os_name != "windows" and os.path.exists(binary_path):
|
|
77
|
+
os.chmod(binary_path, 0o755)
|
|
78
|
+
|
|
79
|
+
print("envguard installation complete.")
|
|
80
|
+
|
|
81
|
+
def run():
|
|
82
|
+
current_dir = os.path.dirname(os.path.abspath(__file__))
|
|
83
|
+
os_name, arch_name = get_platform_details()
|
|
84
|
+
binary_name = "envguard.exe" if os_name == "windows" else "envguard"
|
|
85
|
+
binary_path = os.path.join(current_dir, binary_name)
|
|
86
|
+
|
|
87
|
+
if not os.path.exists(binary_path):
|
|
88
|
+
download_binary(current_dir, os_name, arch_name)
|
|
89
|
+
|
|
90
|
+
args = sys.argv[1:]
|
|
91
|
+
try:
|
|
92
|
+
res = subprocess.run([binary_path] + args)
|
|
93
|
+
sys.exit(res.returncode)
|
|
94
|
+
except Exception as e:
|
|
95
|
+
print(f"Failed to execute envguard: {e}", file=sys.stderr)
|
|
96
|
+
sys.exit(2)
|
|
97
|
+
|
|
98
|
+
if __name__ == "__main__":
|
|
99
|
+
run()
|
|
@@ -0,0 +1,196 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: envguard-bin
|
|
3
|
+
Version: 1.0.3
|
|
4
|
+
Summary: The ESLint for environment variables
|
|
5
|
+
Author: Vamshavardhan50
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/Vamshavardhan50/envguard
|
|
8
|
+
Classifier: Programming Language :: Python :: 3
|
|
9
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Requires-Python: >=3.7
|
|
12
|
+
Description-Content-Type: text/markdown
|
|
13
|
+
|
|
14
|
+
# envguard 🛡️
|
|
15
|
+
|
|
16
|
+
[](https://github.com/Vamshavardhan50/envguard/actions/workflows/ci.yml)
|
|
17
|
+
[](https://github.com/Vamshavardhan50/envguard/actions/workflows/release.yml)
|
|
18
|
+
[](https://opensource.org/licenses/MIT)
|
|
19
|
+
|
|
20
|
+
> **Think of `envguard` as a spell-checker/linter for your environment variables.**
|
|
21
|
+
> It scans your code, checks your `.env` files, and makes sure you never break your app in production due to a missing or misconfigured setting. It is fast, works 100% offline, and requires zero configuration to start.
|
|
22
|
+
|
|
23
|
+
---
|
|
24
|
+
|
|
25
|
+
## What is envguard?
|
|
26
|
+
Have you ever deployed an app, only for it to immediately crash because you forgot to copy a new API key to the server? Or because someone configured `PORT` as a word instead of a number?
|
|
27
|
+
|
|
28
|
+
`envguard` solves this by automatically finding all environment variables your code uses (like `process.env.DATABASE_URL` or `os.environ.get('PORT')`) and checking them against your `.env` configuration file. It warns you immediately about:
|
|
29
|
+
- ❌ **Missing variables** that your code expects but are not configured.
|
|
30
|
+
- ⚠️ **Unused variables** in `.env` that your code doesn't actually use.
|
|
31
|
+
- 🚫 **Invalid formats** (e.g. database URLs that are not valid URLs, or ports that are not numbers).
|
|
32
|
+
|
|
33
|
+
---
|
|
34
|
+
|
|
35
|
+
## ⚡ Quick 1-Minute Start
|
|
36
|
+
|
|
37
|
+
Get up and running in three simple steps:
|
|
38
|
+
|
|
39
|
+
### 1. Install it
|
|
40
|
+
Run the install command for your favorite package manager:
|
|
41
|
+
|
|
42
|
+
```bash
|
|
43
|
+
# Using Node (NPM)
|
|
44
|
+
npm install -g envguard-bin
|
|
45
|
+
|
|
46
|
+
# Using Python (PIP)
|
|
47
|
+
pip install envguard
|
|
48
|
+
|
|
49
|
+
# Using Go
|
|
50
|
+
go install github.com/Vamshavardhan50/envguard@latest
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
### 2. Set it up
|
|
54
|
+
Run the setup wizard in your project folder. It will scan your project, find your environment variables, and create a safe configuration file (`.envguard.yaml`) for you:
|
|
55
|
+
|
|
56
|
+
```bash
|
|
57
|
+
envguard init
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
### 3. Guard your project
|
|
61
|
+
Scan your project to find any discrepancies:
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
envguard audit
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## 🔒 Security & Privacy First
|
|
70
|
+
|
|
71
|
+
- **100% Offline:** `envguard` never makes network requests and never uploads anything.
|
|
72
|
+
- **Privacy-Engineered:** It only reads and displays the **names** of the keys (e.g. `STRIPE_API_KEY`). It **never** reads, logs, or prints the actual secret values.
|
|
73
|
+
|
|
74
|
+
---
|
|
75
|
+
|
|
76
|
+
## 🛠️ How to Use: Common Tasks
|
|
77
|
+
|
|
78
|
+
Here is how to run `envguard`'s most common commands in your project:
|
|
79
|
+
|
|
80
|
+
### 🔍 Find Missing or Unused Keys
|
|
81
|
+
To check if your local `.env` file matches what your code actually uses, run:
|
|
82
|
+
```bash
|
|
83
|
+
envguard audit
|
|
84
|
+
```
|
|
85
|
+
*Tip: In your CI/CD pipelines, run `envguard audit --ci` to automatically fail build pipelines if keys are missing.*
|
|
86
|
+
|
|
87
|
+
---
|
|
88
|
+
|
|
89
|
+
### 🛡️ Check If Values Are Correct (Validation)
|
|
90
|
+
You can define rules in `.envguard.yaml` (e.g., checking if `DATABASE_URL` is a valid URL, or `PORT` is a number). To validate your current configuration against these rules, run:
|
|
91
|
+
```bash
|
|
92
|
+
envguard validate
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
---
|
|
96
|
+
|
|
97
|
+
### 📝 Auto-Update Your `.env.example` Template
|
|
98
|
+
Stop updating `.env.example` templates manually! Run this command to automatically read your `.env` file and generate a clean `.env.example` containing only the keys (values are safely stripped):
|
|
99
|
+
```bash
|
|
100
|
+
envguard sync --force
|
|
101
|
+
```
|
|
102
|
+
|
|
103
|
+
---
|
|
104
|
+
|
|
105
|
+
### 🩺 Run a Project Health Check
|
|
106
|
+
To perform a structure audit of your environment file setup (making sure `.env` is inside `.gitignore` so you don't accidentally publish secrets, checking file integrity, etc.), run:
|
|
107
|
+
```bash
|
|
108
|
+
envguard doctor
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
---
|
|
112
|
+
|
|
113
|
+
## ⚙️ Advanced Configuration (`.envguard.yaml`)
|
|
114
|
+
|
|
115
|
+
You can customize how `envguard` behaves by editing your `.envguard.yaml` file. Here is an example:
|
|
116
|
+
|
|
117
|
+
```yaml
|
|
118
|
+
version: 1
|
|
119
|
+
|
|
120
|
+
scan:
|
|
121
|
+
paths:
|
|
122
|
+
- "."
|
|
123
|
+
ignore:
|
|
124
|
+
- "node_modules"
|
|
125
|
+
- ".git"
|
|
126
|
+
- "dist"
|
|
127
|
+
languages:
|
|
128
|
+
- auto # Auto-detects JavaScript, TypeScript, Python, Go, Rust, Ruby, Dockerfiles, etc.
|
|
129
|
+
|
|
130
|
+
# Define rules for validating values
|
|
131
|
+
rules:
|
|
132
|
+
DATABASE_URL:
|
|
133
|
+
required: true
|
|
134
|
+
type: url
|
|
135
|
+
description: "Primary PostgreSQL database URL"
|
|
136
|
+
PORT:
|
|
137
|
+
required: false
|
|
138
|
+
type: number
|
|
139
|
+
default: "3000"
|
|
140
|
+
description: "The port the web server runs on"
|
|
141
|
+
NODE_ENV:
|
|
142
|
+
required: true
|
|
143
|
+
type: enum
|
|
144
|
+
values:
|
|
145
|
+
- development
|
|
146
|
+
- production
|
|
147
|
+
- test
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
---
|
|
151
|
+
|
|
152
|
+
## 🤖 Integrate with GitHub Actions
|
|
153
|
+
|
|
154
|
+
Add `envguard` to your GitHub Actions workflow to block pull requests containing invalid or incomplete configurations:
|
|
155
|
+
|
|
156
|
+
```yaml
|
|
157
|
+
name: Guard Environment
|
|
158
|
+
|
|
159
|
+
on:
|
|
160
|
+
push:
|
|
161
|
+
branches: [main]
|
|
162
|
+
pull_request:
|
|
163
|
+
branches: [main]
|
|
164
|
+
|
|
165
|
+
jobs:
|
|
166
|
+
audit:
|
|
167
|
+
runs-on: ubuntu-latest
|
|
168
|
+
steps:
|
|
169
|
+
- uses: actions/checkout@v4
|
|
170
|
+
- name: Setup Go
|
|
171
|
+
uses: actions/setup-go@v5
|
|
172
|
+
with:
|
|
173
|
+
go-version: "1.22"
|
|
174
|
+
- name: Install envguard
|
|
175
|
+
run: go install github.com/Vamshavardhan50/envguard@latest
|
|
176
|
+
- name: Run audit
|
|
177
|
+
run: envguard audit --ci --format github
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
---
|
|
181
|
+
|
|
182
|
+
## 🙋 Frequently Asked Questions (FAQ)
|
|
183
|
+
|
|
184
|
+
### Does `envguard` send my secrets to a third-party server?
|
|
185
|
+
**No.** `envguard` runs entirely on your local machine. It does not send any telemetry, analytics, or credentials over the internet.
|
|
186
|
+
|
|
187
|
+
### What languages does the code scanner support?
|
|
188
|
+
`envguard` scans JavaScript (`process.env.VAR`), TypeScript, React/Vue (`import.meta.env.VAR` or `process.env.VAR`), Python (`os.environ`), Go (`os.Getenv`), Ruby, Rust, PHP, Java, Shell scripts, and Dockerfiles out-of-the-box.
|
|
189
|
+
|
|
190
|
+
### How is this different from other dotenv validators?
|
|
191
|
+
Unlike most tools, `envguard` does not just check if a `.env` file exists. It **statically scans your source code files** to find what keys your code actually references, highlighting code references that are completely missing from your config.
|
|
192
|
+
|
|
193
|
+
---
|
|
194
|
+
|
|
195
|
+
## 📄 License
|
|
196
|
+
This project is open-source software licensed under the [MIT License](LICENSE).
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
envguard
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=61.0.0"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "envguard-bin"
|
|
7
|
+
version = "1.0.3"
|
|
8
|
+
description = "The ESLint for environment variables"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
requires-python = ">=3.7"
|
|
11
|
+
license = {text = "MIT"}
|
|
12
|
+
authors = [
|
|
13
|
+
{name = "Vamshavardhan50"}
|
|
14
|
+
]
|
|
15
|
+
classifiers = [
|
|
16
|
+
"Programming Language :: Python :: 3",
|
|
17
|
+
"License :: OSI Approved :: MIT License",
|
|
18
|
+
"Operating System :: OS Independent",
|
|
19
|
+
]
|
|
20
|
+
|
|
21
|
+
[project.urls]
|
|
22
|
+
"Homepage" = "https://github.com/Vamshavardhan50/envguard"
|
|
23
|
+
|
|
24
|
+
[project.scripts]
|
|
25
|
+
envguard = "envguard.main:run"
|