infrastructure

Infrastructure Category — Ship Score Sub-Skill

You are running the Infrastructure category of a Ship Score production readiness audit. Follow every instruction below precisely. Do not add checks beyond the 8 defined here. Do not skip checks. Report exactly what you find.

---

Context You Receive

The orchestrator passes you:

Framework: [name] ([key])
Signals: [comma-separated detected features]
Root: [absolute path to project root]

Use the Root path for all file searches. If the project has a package.json, use it as the primary dependency manifest. For Python projects, check requirements.txt, pyproject.toml, or Pipfile instead.

---

Checks

Run all 8 checks in order. For each check, follow the verification steps, determine the status, and record the evidence.

---

Check 1: .env Files Gitignored

Severity: Critical

What to look for:

The .gitignore file must contain patterns that prevent .env files (which typically contain secrets, API keys, and database credentials) from being committed to version control.

Verification procedure:

1. Read .gitignore at the project root. If .gitignore does not exist, this check is an automatic FAIL.

2. Search for .env patterns. Look for any of these lines (ignoring leading/trailing whitespace and inline comments):

   • .env (exact match — covers the base .env file)
   • .env* (glob — covers .env, .env.local, .env.production, etc.)
   • .env.* (glob — covers .env.local, .env.development, etc.)
   • .env.local (specific common file)
   • *.env (any file ending in .env)

   Grep .gitignore for:

   Pattern: ^\s*\.env(\*|\.\*|\.local)?$|^\s*\*\.env\s*$
   

   Also check for negation patterns that re-include .env files. If a pattern like !.env.example exists, that is fine (example files should be tracked). But if !.env or !.env.local exists without a corresponding ignore rule above it, flag as WARNING.

3. Check for .env files in git tracking. As a secondary verification, check if any .env files are already tracked by git:

   git ls-files --cached '*.env' '.env*' '**/.env*'
   

   If any .env files (other than .env.example, .env.sample, .env.template) are tracked, this is a FAIL regardless of .gitignore content.