Repository navigation
feat(config): unknown WALGIT__ overrides fail closed - #100
Open
jonasgrosch wants to merge 2 commits into
Open
jonasgrosch wants to merge 2 commits into
jonasgrosch wants to merge 2 commits into
Conversation
An environment override this build could not apply was dropped with a WARN: `WALGIT__SERVER__LSITEN=0.0.0.0:8080` left the server on the default 127.0.0.1:8080, a wrong-typed value likewise ran the default. The file itself already refuses unknown keys (`deny_unknown_fields`); the env path now does the same. A malformed name, an unknown section or key, or a value of the wrong type is an error at startup and in `walgit config check`, naming every such variable at once and, for an unknown key, the nearest known one: WALGIT__SERVER__LSITEN: unknown key `lsiten` in [server]; did you mean WALGIT__SERVER__LISTEN? Nothing of a refused batch is applied. The nearest key comes from serde's own `expected one of` list (Levenshtein over the siblings, no new dependency). No escape hatch. The warn-and-ignore loader existed for config/image skew (2026-08-21: a host on an older image crash-looped on a newer key), not for foreign variables sharing the prefix — nothing in the tree sets a non-config `WALGIT__*` name. That case is answered by ordering (image before the env that needs it) and by `config check --env-file` run by the binary that will serve; `--strict` and `apply_env_report` are removed, as the check is now always strict. Recorded as D50. walgit-config no longer uses tracing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
walgit.example.toml documents "every key with its default", but its [store.s3] block showed AWS values: `force_path_style = false` and an AWS endpoint, while `S3Config::default()` is `force_path_style = true` with `endpoint = "http://127.0.0.1:9000"`. The code is right: the flag goes straight to aws-sdk-s3, and the default endpoint is the local rustfs/MinIO rig, which needs path-style addressing (s3.rs notes it as required for rustfs; virtual-hosted would address `bucket.host`). So the example follows the code, and says when to set false (AWS, virtual-hosted addressing). `example_configurations_parse_ and_validate` now pins the example's [store.s3] to the default. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 7, 2026
nibzard
added a commit
to nibzard/walgit
that referenced
this pull request
Oct 15, 2026
…t apply Co-Authored-By: Claude Code <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WALGIT__SERVER__LSITEN=0.0.0.0:8080was dropped with a WARN and the server ran on the defaultlisten address; a wrong-typed value did the same. The TOML file already refuses unknown keys
(
deny_unknown_fields); the environment path now matches it.walgit config check, naming every such variable and, for a typo, the nearest known key:WALGIT__SERVER__LSITEN: unknown keylsitenin [server]; did you mean WALGIT__SERVER__LISTEN?expected one oflist; no new dependency.skew (2026-08-21); that is now ordering plus
config check --env-filerun by the serving binary.--strictandapply_env_reportare removed (the check is always strict). Recorded as D50 —this reverses the earlier warn-and-ignore decision, so push back if you'd rather keep a switch.
walgit.example.toml[store.s3]now shows the real defaults (force_path_style = true,local endpoint): the default endpoint is the rustfs/MinIO rig, which needs path-style. Pinned by a test.
Tests: unit test for every refusal kind;
walgit-cli/tests/config_env.rsdrives the real binaries(typo refused by
config checkand bywalgit-serverstartup; valid override applied).cargo fmt --all --checkandcargo clippy --locked --workspace --all-targets -- -D warningsclean.🤖 Generated with Claude Code