You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+95-9Lines changed: 95 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -77,6 +77,30 @@ make deploy ENV=staging IMAGE_TAG=v1.0.0
77
77
78
78
### Principle: **Secrets in Code = Never**
79
79
80
+
All environment configuration is centralized in `config/` folder:
81
+
82
+
**Tracked in Git (✅):**
83
+
- `config/.env.*.example` - Templates for each environment
84
+
- `.gitignore` - Security rules
85
+
86
+
**Never in Git (❌):**
87
+
- `config/.env.dev` - Development settings
88
+
- `config/.env.test` - Testing settings
89
+
- `config/.env.local` - Local overrides
90
+
- `config/.env.prod` - Production settings
91
+
92
+
**For CI/CD:**
93
+
- GitHub Secrets stored in repository settings
94
+
- Used via `${{ secrets.SECRET_NAME }}` in workflows
95
+
- OIDC token for AWS authentication (no hardcoded credentials)
96
+
97
+
**For Runtime:**
98
+
- AWS Secrets Manager for sensitive data
99
+
- ECS task definitions inject secrets as environment variables
100
+
- Application reads from environment at runtime
101
+
102
+
See [docs/ENVIRONMENT_CONFIGURATION.md](docs/ENVIRONMENT_CONFIGURATION.md) for complete setup guide.
103
+
80
104
**For CI/CD:**
81
105
- GitHub Secrets stored in repository settings (AWS_ROLE_TO_ASSUME, DB passwords, etc.)
82
106
- Used via `${{ secrets.SECRET_NAME }}` in workflows
@@ -89,23 +113,85 @@ make deploy ENV=staging IMAGE_TAG=v1.0.0
89
113
- Terraform manages secrets creation in AWS
90
114
91
115
**For Local Development:**
92
-
- Copy `config/.env.example` to `.env.local`
93
-
- Fill in local values (never commit `.env.local`)
94
-
- Used by scripts via `source .env.local`
116
+
- Copy `config/.env.dev.example` to `config/.env.dev`
117
+
- Copy `config/.env.test.example` to `config/.env.test`
118
+
- Optional: `config/.env.local` for local overrides
119
+
- All .env files in `config/` are git-ignored (never committed)
95
120
96
-
See [docs/SECRETS_MANAGEMENT.md](docs/SECRETS_MANAGEMENT.md) for detailed patterns.
121
+
See [docs/SECRETS_MANAGEMENT.md](docs/SECRETS_MANAGEMENT.md) for detailed patterns and [docs/ENVIRONMENT_CONFIGURATION.md](docs/ENVIRONMENT_CONFIGURATION.md) for environment file structure.
97
122
98
123
## 🧪 Testing Strategy
99
124
100
-
### Backend
125
+
### Backend Testing
126
+
127
+
#### Layer-Based Test Architecture
128
+
Tests are organized into two layers:
129
+
- **Unit Tests** (mocked, no database): Fast validation of business logic (~5 seconds)
0 commit comments