{"slug": "show-hn-configledger-find-configuration-drift-across-code-ci-docker-and-docs", "title": "Show HN: ConfigLedger -Find configuration drift across code, CI, Docker and docs", "summary": "ConfigLedger, a new open-source CLI tool from DevFoundry-labs, detects configuration drift across code, CI, Docker, and documentation without collecting secret values. The tool, available in v0.1, scans multiple surfaces including Python, JavaScript, Docker, and Kubernetes YAML, and flags issues like undefined consumption and sensitive literals. It requires Python 3.12 or newer and can be installed via pip.", "body_md": "**Find configuration drift across code, examples, CI, containers, deployment YAML, and docs—without collecting secret values.**\n\nConfigLedger is a local, deterministic CLI for answering questions that are surprisingly hard in a real repository:\n\n- Where is\n`DATABASE_URL`\n\nconsumed, delivered, exemplified, and documented? - Which active keys have no documented setup path?\n- Which sample or deployment defaults disagree?\n- Which example keys are unused?\n- Did someone put a literal value next to a sensitive-looking key?\n\nIt runs offline, executes no repository code, needs no account, and sends nothing to an AI service.\n\n``` bash\n$ configledger scan examples/demo --no-cache --fail-on none\nConfigLedger\nScanned 4 artifacts; found 4 configuration keys.\nFindings: 1 critical, 2 high, 2 medium, 1 low.\n\n[CRITICAL] config.sensitive-literal — SUPPORT_TOKEN\n  SUPPORT_TOKEN looks sensitive and has a non-placeholder literal in an example surface.\n  - .env.example:3 (example)\n  - app.py:5 (consumption)\n\n[HIGH] config.undefined-consumption — ANALYTICS_KEY\n  ANALYTICS_KEY is consumed but no definition, example, or delivery surface was found.\n  - app.py:4 (consumption)\n```\n\nEnvironment and configuration keys are duplicated across source code, `.env.example`\n\n, Docker, CI, Kubernetes, and documentation. Format-specific linters see one file type; secret scanners look for leaked values. ConfigLedger builds a source-linked, per-key provenance record across all of those surfaces and evaluates transparent drift rules.\n\nConfigLedger does **not** replace a secret manager, configuration loader, or vulnerability scanner. It deliberately analyzes names and safe metadata—not runtime values.\n\nConfigLedger requires Python 3.12 or newer.\n\n```\npython -m pip install configledger\n```\n\nFor development or before the first package-index release:\n\n```\ngit clone https://github.com/DevFoundry-labs/configledger.git\ncd configledger\npython -m pip install .\n```\n\nScan the current repository:\n\n```\nconfigledger scan .\n```\n\nTry the reproducible included demo without letting findings change the shell exit code:\n\n```\nconfigledger scan examples/demo --no-cache --fail-on none\n```\n\nExport machine-readable or review-friendly output:\n\n```\nconfigledger scan . --format json --output configledger-report.json\nconfigledger scan . --format markdown --output configledger-report.md\nconfigledger scan . --format schema --output .env.generated.example\n```\n\nInspect one key:\n\n```\nconfigledger show DATABASE_URL .\n```\n\n| Surface | Evidence recognized in v0.1 |\n|---|---|\n| Python | `os.getenv` , `os.environ` , Pydantic-style settings and aliases |\n| JavaScript / TypeScript | `process.env.KEY` , indexed access, `import.meta.env.KEY` |\n| Dotenv examples | `.env.example` , `.env.sample` , `.env.template` |\n| Dockerfile | `ARG` , `ENV` , and variable references |\n| Docker Compose / YAML | `environment` , `env` , and interpolated variables |\n| GitHub Actions | `env` , `vars` , and `secrets` references |\n| Kubernetes-like YAML | `env` entries and `name` keys (confidence-tagged) |\n| Markdown | Backticked keys, tables, and key/value-style references |\n\nUnsupported or ambiguous syntax is reported as a diagnostic or omitted. ConfigLedger never treats incomplete static evidence as proof that runtime configuration is safe.\n\n| Rule | Default severity | Meaning |\n|---|---|---|\n`config.undefined-consumption` |\nHigh | A consumed key has no definition, example, or delivery evidence. |\n`config.unused-declaration` |\nLow | A defined/example key has no consumption or delivery evidence. |\n`config.undocumented` |\nMedium | An active key has no Markdown documentation evidence. |\n`config.default-drift` |\nHigh | Non-secret default fingerprints disagree across surfaces. |\n`config.sensitive-literal` |\nCritical | A sensitive-looking key has a non-placeholder literal in an example. |\n\nList rules from the installed version:\n\n```\nconfigledger rules\n```\n\nCreate `.configledger.toml`\n\nat the repository root:\n\n```\n[scan]\nignore_paths = [\"vendor/**\", \"generated/**\"]\nignore_keys = [\"TEST_ONLY_*\"]\ninternal_keys = [\"CI\", \"INTERNAL_*\"]\nmax_files = 5000\nmax_file_bytes = 1000000\nmax_total_bytes = 25000000\n\n[rules]\ndisabled = [\"config.unused-declaration\"]\nfail_on = \"high\" # info, low, medium, high, critical, or none\n\n[rules.severity]\n\"config.undocumented\" = \"low\"\n```\n\nCommand-line `--fail-on`\n\noverrides the policy for that run. See [configuration reference](/DevFoundry-labs/configledger/blob/main/docs/configuration.md).\n\nBaselines contain finding fingerprints, not configuration values:\n\n```\nconfigledger baseline create .configledger-baseline.json .\nconfigledger baseline compare .configledger-baseline.json .\n```\n\nThe compare command exits with status 1 when new fingerprints appear.\n\n| Code | Meaning |\n|---|---|\n| 0 | Scan completed and no finding met the failure threshold. |\n| 1 | Findings met the threshold, a key was not found, or baseline comparison found new findings. |\n| 2 | Invalid path, policy, report path, or other usage error. |\n| 3 | Reserved for unexpected internal failures. |\n\n`.env`\n\n,`.env.local`\n\n, private keys, binaries, and common dependency/build directories are excluded before reading.- Example/deployment literals are represented by hashes and redacted excerpts; raw values are not stored in reports or SQLite.\n- Repository modules, scripts, containers, and workflows are never executed.\n- Discovery is bounded and rejects out-of-root symlink reads.\n- Core operation is offline and has no telemetry or AI provider.\n\nRead the [threat model](/DevFoundry-labs/configledger/blob/main/docs/threat-model.md) and [security policy](/DevFoundry-labs/configledger/blob/main/SECURITY.md) before scanning untrusted repositories in sensitive environments.\n\n```\nsafe discovery → format extractors → normalized occurrences\n      → per-key provenance → deterministic rules → reports / SQLite cache\n```\n\nThe CLI, library API, persistence model, and reporter boundaries are described in [architecture.md](/DevFoundry-labs/configledger/blob/main/docs/architecture.md). The versioned JSON contract is [scan-result.schema.json](/DevFoundry-labs/configledger/blob/main/schemas/scan-result.schema.json).\n\n```\npython -m venv .venv\n# Windows: .venv\\Scripts\\activate\n# macOS/Linux: source .venv/bin/activate\npython -m pip install -e \".[dev]\"\nruff format --check .\nruff check .\nmypy src\npytest --cov=configledger --cov-report=term-missing\npython -m build\n```\n\nSee [CONTRIBUTING.md](/DevFoundry-labs/configledger/blob/main/CONTRIBUTING.md) for extractor and rule contribution guidance.\n\n- v0.1: Local inventory, six extractor families, five rules, four report formats, baselines, SQLite cache.\n- v0.2: SARIF, richer framework adapters, GitHub Action annotations, ignore explanations.\n- v0.3: Stable extractor SDK and community compatibility fixtures.\n\nThe project will remain local-first and deterministic. New features must improve configuration provenance rather than turn ConfigLedger into a secret manager or generic code-intelligence platform.\n\nApache License 2.0. See [LICENSE](/DevFoundry-labs/configledger/blob/main/LICENSE).", "url": "https://wpnews.pro/news/show-hn-configledger-find-configuration-drift-across-code-ci-docker-and-docs", "canonical_source": "https://github.com/DevFoundry-labs/configledger/", "published_at": "2026-08-11 05:22:30+00:00", "updated_at": "2026-08-11 05:41:05.939178+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["ConfigLedger", "DevFoundry-labs", "Python"], "alternates": {"html": "https://wpnews.pro/news/show-hn-configledger-find-configuration-drift-across-code-ci-docker-and-docs", "markdown": "https://wpnews.pro/news/show-hn-configledger-find-configuration-drift-across-code-ci-docker-and-docs.md", "text": "https://wpnews.pro/news/show-hn-configledger-find-configuration-drift-across-code-ci-docker-and-docs.txt", "jsonld": "https://wpnews.pro/news/show-hn-configledger-find-configuration-drift-across-code-ci-docker-and-docs.jsonld"}}