Ignore .env.example while warning on .env.production

By Batu · English technical notes

Also published in our Blogger archive.

Direct answer

A filename policy needs an explicit exception when templates and active configuration files have different meanings. The predicate here selects .env-prefixed names but excludes exactly .env.example. That lets a review surface .env.production and .env.local without treating a documented template as the same kind of finding.

The fixture is the edge case: all three names begin with .env, so a prefix-only rule would report too much. The sorted assertion makes the intended policy inspectable and prevents a future broadening from being hidden by directory order.

This check says nothing about values, permissions, ignored files, or whether a non-template file contains credentials. It also does not recognize alternate template names such as .env.sample. Add those only by changing the named rule and its test; a report should show the exact convention it applies.

Complete example

from pathlib import Path
from tempfile import TemporaryDirectory

with TemporaryDirectory() as directory:
    root = Path(directory)
    for name in (".env.example", ".env.production", ".env.local"):
        (root / name).write_text("placeholder", encoding="utf-8")
    flagged = sorted(
        item.name
        for item in root.iterdir()
        if item.name.startswith(".env") and item.name != ".env.example"
    )
    assert flagged == [".env.local", ".env.production"]
    print("flagged=.env.local,.env.production")

Expected stdout:

flagged=.env.local,.env.production

Sources

- pathlib documentation

Prepared with AI assistance. The example uses synthetic data; its stated limits apply.