Merge pull request #152 from Financial-Times/dotenv

Add check for .env

Makefile

@@ -9,9 +9,9 @@ else
 	@echo "README.md out-of-sync with ./bin/next-build-tools.js, run \`make docs\` and commit"
 	@exit 1
 endif
-	./bin/next-build-tools.js verify --skip-layout-checks
+	./bin/next-build-tools.js verify --skip-layout-checks --skip-dotenv-check
 
-test:
+test: verify
 	mocha ./test/
 
 docs:

bin/next-build-tools.js

@@ -98,12 +98,14 @@ program
 	.command('verify')
 	.option('--skip-layout-checks', 'run verify checks when the application doesn\'t have customer facing html pages')
 	.option('--skip-npm-checks', 'skip npm dependency checks')
+	.option('--skip-dotenv-check', 'skip checking `.gitignore` has `.env` in it')
 	.option('-l, --layout [type]', 'Only check dependencies whose templates are needed in this layout')
 	.description('internally calls origami-build-tools verify with some Next specific configuration (use only for APPLICATIONS.  Front End components should continue to use origami-build-tools verify)')
 	.action(function(opts) {
 		verify({
 			skipLayoutChecks: opts.skipLayoutChecks,
 			skipNpmChecks: opts.skipNpmChecks,
+			skipDotenvCheck: opts.skipDotenvCheck,
 			layout: opts.layout
 		}).catch(exit);
 	});

lib/verify-dotenv-in-gitignore.js

@@ -0,0 +1,28 @@
+'use strict';
+
+var path = require('path');
+var denodeify = require('denodeify');
+var readFile = denodeify(require('fs').readFile);
+
+module.exports = function () {
+	return readFile(path.join(process.cwd(), '.gitignore'), { encoding: 'utf-8' })
+		.then(function(gitignore) {
+			gitignore = gitignore.split("\n");
+			if (gitignore.indexOf('.env') === -1) {
+				throw new Error("\n********************************************************"
+					+ "\nPlease add `.env` into this project's `.gitignore` file."
+					+ "\n********************************************************"
+					+ "\nQ: Why?"
+					+ "\nA: Because `next-build-tools` will soon start creating it instead of `.next-development-keys.json` in your home directory."
+					+ "\n\nQ: … why?"
+					+ "\nA: So that we can have per app API keys, it's a nice standard, and it means `next-build-tools` doesn't need to muck about in people's home directories anymore."
+					+ "\n\nQ: O.K. but why do I need to change my `.gitignore` file?"
+					+ "\nA: Without `.env` in `.gitignore` file we risk publishing API keys to git."
+					+ "\n\nQ: Right, but because {{SENSIBLE_REASON}} I don't want to do this."
+					+ "\nA: Fair enough, add `--skip-dotenv-check` to `nbt verify` in this project's `Makefile`"
+					+ "\n\nQ: Shouldn't this have been a major version bump of `next-build-tools`?"
+					+ "\nA: 🐴"
+					+ "\n");
+			}
+		});
+};

tasks/verify.js

@@ -5,6 +5,7 @@ var origamiBuildTools = require('origami-build-tools');
 var path = require('path');
 var verifyLayoutDeps = require('../lib/verify-layout-deps');
 var verifyNpmDeps = require('../lib/verify-npm-deps');
+var verifyDotenvInGitignore = require('../lib/verify-dotenv-in-gitignore');
 
 function obtVerify() {
 	return new Promise(function(resolve, reject) {
@@ -27,5 +28,9 @@ module.exports = function(opts) {
 	if (!opts.skipLayoutChecks) {
 		checks.push(verifyLayoutDeps({ layout: opts.layout }));
 	}
+
+	if (!opts.skipDotenvCheck) {
+		checks.push(verifyDotenvInGitignore());
+	}
 	return Promise.all(checks);
 };