Skip to content

fix: support local .env in addition to ~/.env#143

Merged
aireilly merged 4 commits intomainfrom
fix/support-local-env-file
May 4, 2026
Merged

fix: support local .env in addition to ~/.env#143
aireilly merged 4 commits intomainfrom
fix/support-local-env-file

Conversation

@aireilly
Copy link
Copy Markdown
Member

@aireilly aireilly commented May 2, 2026

Summary

  • Scripts now load both ~/.env (global defaults) and ./.env (local overrides), with local .env taking precedence over ~/.env
  • JIRA_AUTH_TOKEN is accepted as a backward-compatible alias for JIRA_API_TOKEN in all scripts (was missing from jira-ready-check.sh)
  • Added .env to .gitignore to prevent accidental credential commits
  • Updated all documentation (README, SKILL.md files, agent files) to reference both .env locations

Precedence order (highest wins)

  1. Pre-existing environment variables (already set in shell)
  2. Local .env (project-specific overrides)
  3. ~/.env (global defaults)

Changed files

Scripts (5):

  • jira_reader.py, jira_writer.py, git_pr_reader.pyload_env_file() now loads both locations
  • create-jira-ticket.sh — sources both .env files
  • jira-ready-check.sh — sources both .env files + adds JIRA_AUTH_TOKEN fallback

Documentation (13):

  • README.md — documents both locations and JIRA_AUTH_TOKEN alias
  • 5 SKILL.md files — updated credential setup sections
  • 5 agent files — updated error messages and "do not source" notes
  • .gitignore — added .env

Test plan

  • Verify scripts load ~/.env when only ~/.env exists
  • Verify scripts load .env when only local .env exists
  • Verify local .env overrides ~/.env when both exist
  • Verify JIRA_AUTH_TOKEN works as alias in all scripts
  • Verify pre-existing env vars are not overwritten

Closes #127

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features

    • Project-root .env support (local overrides global); backward-compatible JIRA_AUTH_TOKEN accepted.
  • Documentation

    • Clarified auto-loading of .env files (project then global), guidance not to source env files manually, and to check both locations when credentials fail.
  • Chores

    • Plugin manifest version bumped to 0.0.64.
    • Added .env to .gitignore.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 2, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Project adds .env to .gitignore, updates docs and SKILLs to document loading of both project ./.env and ~/.env, replaces unsafe source usage with safe KEY=VALUE parsers in shell scripts, updates Python env loaders to read ./.env then ~/.env without overwriting existing vars, accepts JIRA_AUTH_TOKEN as fallback, and bumps plugin version to 0.0.64. (46 words)

Changes

Environment file loading and credential handling

Layer / File(s) Summary
Ignore local env
.gitignore
Add .env so local env files are not tracked.
Manifest
plugins/docs-tools/.claude-plugin/plugin.json
Bump plugin manifest version 0.0.630.0.64.
Docs / README
plugins/docs-tools/README.md
Document that env may live in ~/.env or project-root ./.env, note precedence, mention JIRA_AUTH_TOKEN alias, and explain scripts auto-load env files.
Agent / SKILL docs
plugins/docs-tools/agents/*.md, plugins/docs-tools/skills/*/SKILL.md
Clarify automatic .env loading, instruct not to source env files, update guidance to check credentials in ./.env or ~/.env, and document token alias where applicable.
Shell: safe env loader
plugins/docs-tools/skills/.../scripts/create-jira-ticket.sh, .../jira-ready-check.sh
Replace source ~/.env with _safe_load_env() that parses KEY=VALUE lines from project-root ./.env and ~/.env (no shell execution), trims/strips quotes, exports only unset variables, and preserves JIRA_AUTH_TOKENJIRA_API_TOKEN fallback; update error messages to reference both env locations.
Python: env loader & auth
plugins/docs-tools/skills/.../scripts/jira_reader.py, .../jira_writer.py, .../git_pr_reader.py
load_env_file() now reads ./.env then ~/.env, ignores comments/blank lines, strips surrounding quotes, and uses os.environ.setdefault to avoid overwriting existing environment variables; accept JIRA_AUTH_TOKEN as fallback for JIRA_API_TOKEN and update missing-token/error messages to reference ./.env or ~/.env.
Messages / Errors
multiple scripts (.../jira_reader.py, .../jira_writer.py, .../jira-ready-check.sh, .../git_pr_reader.py)
Standardize missing-credential/error texts to instruct adding credentials to ./.env or ~/.env.

Sequence Diagram(s)

(Skipped — changes are documentation and local env-loading adjustments without introducing a new multi-component runtime control flow that benefits from a sequence diagram.)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Plugin Registry Consistency ❌ Error The PR updated plugin.json version from 0.0.63 to 0.0.64 but did not update the corresponding entry in marketplace.json, creating a version mismatch. Update the docs-tools plugin entry in marketplace.json to include version 0.0.64 to match plugin.json.
✅ Passed checks (9 passed)
Check name Status Explanation
Title check ✅ Passed The PR title directly summarizes the main change: supporting local .env files in addition to global ~/.env files, which is the primary objective of the changeset.
Linked Issues check ✅ Passed All coding requirements from issue #127 are met: Python scripts load both .env locations with proper precedence, shell scripts source both files, .env added to .gitignore, backward-compatible JIRA_AUTH_TOKEN alias implemented, and documentation updated throughout.
Out of Scope Changes check ✅ Passed All changes are directly related to issue #127 requirements. Updates to .gitignore, Python/shell scripts, documentation, and agent files all address the stated objectives of supporting local .env with proper precedence and backward compatibility.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
No Real People Names In Style References ✅ Passed Comprehensive search of all modified documentation, agent, skill, and script files found no references to real people by name in style references, plugin commands, skill documentation, or example prompts.
Git Safety Rules ✅ Passed No git operations involving push commands, hardcoded remotes, or force push detected in modified files.
No Untrusted Mcp Servers ✅ Passed This PR does not introduce untrusted MCP server installations; changes only include .gitignore updates, documentation revisions for .env file support, and environment variable loading logic modifications.
Skill And Script Conventions ✅ Passed All modified SKILL.md and agent files follow proper skill naming conventions without plugin: prefixes or slash-command syntax; script invocations use appropriate relative paths and sourcing patterns.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/support-local-env-file

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 2, 2026

@aireilly aireilly force-pushed the fix/support-local-env-file branch from ccddf29 to c323a7e Compare May 2, 2026 12:13
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 9

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh`:
- Around line 18-20: The script currently sources a local ".env" relative to the
current working directory which can fail if the script is invoked from
elsewhere; update create-jira-ticket.sh to compute the project root from the
PLAN_FILE variable (or fallback to BASE_PATH/PLAN_FILE if needed), resolve the
".env" path against that root (e.g., project_root/.env) and source that resolved
path instead of plain ".env" so the local overrides are reliably loaded;
reference the existing PLAN_FILE and/or BASE_PATH variables when building the
absolute path and only attempt to source if the resolved file exists.

In `@plugins/docs-tools/skills/docs-workflow-create-jira/SKILL.md`:
- Line 31: Update the documentation sentence to note that create-jira-ticket.sh
accepts a backward-compatible alias by mentioning both environment variable
names: JIRA_API_TOKEN (preferred) and JIRA_AUTH_TOKEN (fallback), and also state
that JIRA_EMAIL is required; reference the script name create-jira-ticket.sh and
the exact env var names so readers know the fallback is supported.

In
`@plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh`:
- Around line 64-65: Replace the unsafe "set -a; source ~/.env" and "set -a;
source .env" usage with a safe key/value parser: first capture the current
environment keys (e.g., export -p or env | cut to a set), then parse ~/.env
line-by-line (ignoring non-KEY=VALUE lines and shell commands) and export values
only for keys that do not already exist, then parse .env likewise but only set
keys that were present before the script started (i.e., do not overwrite
pre-existing exports); ensure parsing skips/strips quotes, comments, and empty
lines and logs/ignores malformed lines, and apply the same replacement for both
occurrences of the source commands (the two "set -a; source ..." statements
referring to ~/.env and .env).
- Around line 62-66: The script only sources ~/.env and .env when JIRA_API_TOKEN
is empty, which can leave JIRA_EMAIL undefined; update the logic so the env
files are sourced unconditionally (or at least when either JIRA_API_TOKEN or
JIRA_EMAIL is missing) by moving or duplicating the set -a; source ~/.env and
set -a; source .env calls outside the if block (referencing JIRA_API_TOKEN,
JIRA_EMAIL and the existing source lines) so credentials from .env are always
available before the later checks.

In `@plugins/docs-tools/skills/git-pr-reader/scripts/git_pr_reader.py`:
- Around line 91-101: The load_env_file() loop currently assigns variables from
".env" with os.environ[key.strip()] = value.strip(), which overwrites existing
shell env vars; change that assignment to use os.environ.setdefault(key.strip(),
value.strip()) so both "~/.env" and ".env" only set values when the variable is
not already present (refer to the env_path loop and the os.environ usage inside
load_env_file).

In `@plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py`:
- Around line 153-155: The error message for the missing token is too long and
must mention both accepted env names; update the ValueError raised after the
token lookup (the token = os.environ.get("JIRA_API_TOKEN") or
os.environ.get("JIRA_AUTH_TOKEN") block) to use a wrapped/parenthesized string
under 100 chars that explicitly names both JIRA_API_TOKEN and the legacy
JIRA_AUTH_TOKEN alias so Ruff is satisfied and the message matches the lookup
logic.
- Around line 133-143: The loop that loads .env files currently overwrites
pre-existing environment variables when env_path == ".env" by using direct
assignment to os.environ; change that behavior so both branches use
os.environ.setdefault (or otherwise check for existing keys before assigning) so
that existing exported env vars are preserved; update the block that processes
lines (the for env_path in [...] loop and the key/value handling logic) to call
os.environ.setdefault(key.strip(), value.strip()) for both
os.path.expanduser("~/.env") and ".env" instead of assigning with
os.environ[key] = value.

In `@plugins/docs-tools/skills/jira-writer/scripts/jira_writer.py`:
- Line 62: The ValueError message in the raise ValueError(...) call exceeds the
project's line-length limit (Ruff E501); shorten or split the string so the line
is within the limit — for example replace the long literal with a shorter
message like "JIRA_API_TOKEN env var not set. Add to .env or ~/.env" or split it
across two concatenated literals (e.g. "JIRA_API_TOKEN environment variable not
set. " + "Add it to .env or ~/.env") in the raise ValueError(...) expression to
keep the code style checker satisfied.
- Around line 35-45: The loop loading .env files currently overwrites existing
environment variables when env_path == ".env" due to using os.environ[...] =
value; change that assignment so the code only sets the key if it is not already
present (e.g., use os.environ.setdefault or check key in os.environ before
setting) so pre-existing process env vars retain precedence; update the block
that handles env_path == ".env" (the loop over env_path and the branch that does
os.environ[...] = ...) to use a non-overwriting set operation.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 855d12d7-4d10-4d38-bf28-72021ec0e5c7

📥 Commits

Reviewing files that changed from the base of the PR and between 6d59a71 and ccddf29.

📒 Files selected for processing (21)
  • .gitignore
  • plugins/docs-tools/.claude-plugin/plugin.json
  • plugins/docs-tools/README.md
  • plugins/docs-tools/agents/docs-planner.md
  • plugins/docs-tools/agents/docs-writer.md
  • plugins/docs-tools/agents/requirements-analyst.md
  • plugins/docs-tools/agents/requirements-discoverer.md
  • plugins/docs-tools/agents/technical-reviewer.md
  • plugins/docs-tools/skills/docs-orchestrator/SKILL.md
  • plugins/docs-tools/skills/docs-review-style/SKILL.md
  • plugins/docs-tools/skills/docs-review-technical/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-create-jira/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh
  • plugins/docs-tools/skills/docs-workflow-jira-ready/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh
  • plugins/docs-tools/skills/git-pr-reader/SKILL.md
  • plugins/docs-tools/skills/git-pr-reader/scripts/git_pr_reader.py
  • plugins/docs-tools/skills/jira-reader/SKILL.md
  • plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py
  • plugins/docs-tools/skills/jira-writer/SKILL.md
  • plugins/docs-tools/skills/jira-writer/scripts/jira_writer.py

Comment thread plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh Outdated
Comment thread plugins/docs-tools/skills/docs-workflow-create-jira/SKILL.md Outdated
Comment thread plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh Outdated
Comment thread plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh Outdated
Comment thread plugins/docs-tools/skills/git-pr-reader/scripts/git_pr_reader.py Outdated
Comment thread plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py Outdated
Comment thread plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py Outdated
Comment thread plugins/docs-tools/skills/jira-writer/scripts/jira_writer.py Outdated
Comment thread plugins/docs-tools/skills/jira-writer/scripts/jira_writer.py Outdated
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (3)
plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh (1)

18-20: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Resolve the local .env path against the project root.

source .env only works when the script is launched from the repo root. The orchestrator sets an absolute BASE_PATH but does not guarantee the script runs from that location. If invoked from any other working directory (e.g., from .agent_workspace), the local override silently fails, breaking the core feature of this PR.

Derive the project root from PLAN_FILE and source that file explicitly.

🔧 Proposed fix
+PROJECT_ROOT="$(cd "$(dirname "$PLAN_FILE")/.." && pwd)"
+
 # Load global defaults, then local overrides
 source ~/.env 2>/dev/null || true
-source .env 2>/dev/null || true
+source "${PROJECT_ROOT}/.env" 2>/dev/null || true
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh`
around lines 18 - 20, The local .env is being sourced with a relative path which
fails if the script isn't run from the repo root; instead resolve the project
root from the PLAN_FILE (or BASE_PATH) and source the env file using that
absolute path. Update the script (create-jira-ticket.sh) to compute the project
root from the PLAN_FILE variable (e.g., dirname/resolve PLAN_FILE) and then
source "$PROJECT_ROOT/.env" (and keep sourcing ~/.env first), ensuring the
explicit absolute path is used so the local overrides are applied regardless of
current working directory.
plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh (2)

62-66: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

JIRA_EMAIL can be missed because env loading is gated on token presence.

Line 62 only loads env files when JIRA_API_TOKEN is empty. If the token is exported but JIRA_EMAIL is only in .env/~/.env, Line 75 will fail even though credentials exist in the env files.

🔧 Suggested fix
-if [[ -z "${JIRA_API_TOKEN:-}" ]]; then
-  # Load global defaults, then local overrides
-  set -a; source ~/.env 2>/dev/null || true; set +a
-  set -a; source .env 2>/dev/null || true; set +a
-fi
+# Load global defaults, then local overrides
+set -a; source ~/.env 2>/dev/null || true; set +a
+set -a; source .env 2>/dev/null || true; set +a
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh`
around lines 62 - 66, The env-file loading is gated on JIRA_API_TOKEN which can
cause JIRA_EMAIL to be missing later; move or change the logic so that the lines
that source ~/.env and .env (the set -a; source ~/.env ... and set -a; source
.env ...) are executed unconditionally (or at least before any checks that rely
on JIRA_EMAIL or JIRA_API_TOKEN), then perform the empty-variable checks for
JIRA_API_TOKEN and JIRA_EMAIL afterwards; update references to JIRA_API_TOKEN
and JIRA_EMAIL so the script reads values provided by the sourced files even
when JIRA_API_TOKEN is already exported.

64-65: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Multiple issues with direct .env sourcing: precedence violation, path resolution, and safety.

  1. Precedence violation: source overwrites pre-existing environment variables, violating the PR objective that "pre-existing environment variables" have highest precedence. To honor that contract, you must check whether each key exists before setting it.

  2. Path resolution: source .env is relative to the current working directory. If this script is invoked from a different directory (e.g., from .agent_workspace), the local override will silently fail.

  3. Safety concern: Directly sourcing .env executes arbitrary shell commands. While .env files are user-controlled (not untrusted), a safer key/value parser would avoid command execution.

🔧 Recommended fix

Replace the unsafe source usage with a safe key/value parser that:

  1. Captures initial environment keys
  2. Loads ~/.env as defaults
  3. Loads local .env (resolved to project root) as overrides
  4. Only sets keys that don't already exist in the pre-script environment

Example implementation:

# Capture pre-existing keys
EXISTING_KEYS=$(export -p | sed -n 's/^declare -x \([^=]*\)=.*/\1/p' | sort)

# Function to safely load env file
load_env_file() {
  local file="$1"
  [[ -f "$file" ]] || return 0
  
  while IFS='=' read -r key value; do
    # Skip comments, empty lines, and malformed lines
    [[ "$key" =~ ^[[:space:]]*# ]] && continue
    [[ -z "$key" ]] && continue
    [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
    
    # Only set if not already in environment
    if ! grep -qFx "$key" <<<"$EXISTING_KEYS"; then
      # Strip quotes and export
      value="${value%\"}"
      value="${value#\"}"
      export "$key=$value"
    fi
  done < <(grep -v '^[[:space:]]*$' "$file")
}

# Resolve project root from script location or a known anchor
# Adjust based on your repo structure
PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"

# Load global defaults, then local overrides
load_env_file ~/.env
load_env_file "${PROJECT_ROOT}/.env"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh`
around lines 64 - 65, Replace the two unsafe "set -a; source ..." lines in
jira-ready-check.sh with a safe loader: capture pre-existing environment keys
into EXISTING_KEYS, implement a load_env_file function that parses key=value
lines (skipping comments, malformed lines, stripping quotes) and only exports
keys not present in EXISTING_KEYS, resolve the local .env path from the script
location (e.g., using BASH_SOURCE to compute PROJECT_ROOT) and then call
load_env_file for ~/.env first and the resolved PROJECT_ROOT/.env second so
defaults are loaded then local overrides without overwriting pre-existing
environment variables.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In
`@plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh`:
- Around line 18-20: The local .env is being sourced with a relative path which
fails if the script isn't run from the repo root; instead resolve the project
root from the PLAN_FILE (or BASE_PATH) and source the env file using that
absolute path. Update the script (create-jira-ticket.sh) to compute the project
root from the PLAN_FILE variable (e.g., dirname/resolve PLAN_FILE) and then
source "$PROJECT_ROOT/.env" (and keep sourcing ~/.env first), ensuring the
explicit absolute path is used so the local overrides are applied regardless of
current working directory.

In
`@plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh`:
- Around line 62-66: The env-file loading is gated on JIRA_API_TOKEN which can
cause JIRA_EMAIL to be missing later; move or change the logic so that the lines
that source ~/.env and .env (the set -a; source ~/.env ... and set -a; source
.env ...) are executed unconditionally (or at least before any checks that rely
on JIRA_EMAIL or JIRA_API_TOKEN), then perform the empty-variable checks for
JIRA_API_TOKEN and JIRA_EMAIL afterwards; update references to JIRA_API_TOKEN
and JIRA_EMAIL so the script reads values provided by the sourced files even
when JIRA_API_TOKEN is already exported.
- Around line 64-65: Replace the two unsafe "set -a; source ..." lines in
jira-ready-check.sh with a safe loader: capture pre-existing environment keys
into EXISTING_KEYS, implement a load_env_file function that parses key=value
lines (skipping comments, malformed lines, stripping quotes) and only exports
keys not present in EXISTING_KEYS, resolve the local .env path from the script
location (e.g., using BASH_SOURCE to compute PROJECT_ROOT) and then call
load_env_file for ~/.env first and the resolved PROJECT_ROOT/.env second so
defaults are loaded then local overrides without overwriting pre-existing
environment variables.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e8e2eb27-2a98-45ee-80dd-ee328ddbecec

📥 Commits

Reviewing files that changed from the base of the PR and between ccddf29 and c323a7e.

📒 Files selected for processing (21)
  • .gitignore
  • plugins/docs-tools/.claude-plugin/plugin.json
  • plugins/docs-tools/README.md
  • plugins/docs-tools/agents/docs-planner.md
  • plugins/docs-tools/agents/docs-writer.md
  • plugins/docs-tools/agents/requirements-analyst.md
  • plugins/docs-tools/agents/requirements-discoverer.md
  • plugins/docs-tools/agents/technical-reviewer.md
  • plugins/docs-tools/skills/docs-orchestrator/SKILL.md
  • plugins/docs-tools/skills/docs-review-style/SKILL.md
  • plugins/docs-tools/skills/docs-review-technical/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-create-jira/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh
  • plugins/docs-tools/skills/docs-workflow-jira-ready/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh
  • plugins/docs-tools/skills/git-pr-reader/SKILL.md
  • plugins/docs-tools/skills/git-pr-reader/scripts/git_pr_reader.py
  • plugins/docs-tools/skills/jira-reader/SKILL.md
  • plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py
  • plugins/docs-tools/skills/jira-writer/SKILL.md
  • plugins/docs-tools/skills/jira-writer/scripts/jira_writer.py
✅ Files skipped from review due to trivial changes (13)
  • .gitignore
  • plugins/docs-tools/skills/docs-workflow-jira-ready/SKILL.md
  • plugins/docs-tools/skills/git-pr-reader/SKILL.md
  • plugins/docs-tools/.claude-plugin/plugin.json
  • plugins/docs-tools/skills/jira-writer/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-create-jira/SKILL.md
  • plugins/docs-tools/skills/docs-orchestrator/SKILL.md
  • plugins/docs-tools/skills/jira-reader/SKILL.md
  • plugins/docs-tools/agents/requirements-discoverer.md
  • plugins/docs-tools/agents/requirements-analyst.md
  • plugins/docs-tools/skills/docs-review-style/SKILL.md
  • plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py
  • plugins/docs-tools/agents/technical-reviewer.md
🚧 Files skipped from review as they are similar to previous changes (5)
  • plugins/docs-tools/skills/git-pr-reader/scripts/git_pr_reader.py
  • plugins/docs-tools/agents/docs-planner.md
  • plugins/docs-tools/agents/docs-writer.md
  • plugins/docs-tools/skills/jira-writer/scripts/jira_writer.py
  • plugins/docs-tools/skills/docs-review-technical/SKILL.md

Harden .env loading across all docs-tools scripts:

- Shell scripts: resolve .env from project root (via git rev-parse) instead
  of relying on CWD; use safe key/value parser instead of source to prevent
  arbitrary shell execution from .env files
- Python scripts: use setdefault for both .env and ~/.env so pre-existing
  env vars are never overwritten; load .env before ~/.env so local settings
  take precedence; strip surrounding quotes from values
- jira-ready-check.sh: source env unconditionally (not just when
  JIRA_API_TOKEN is empty) so JIRA_EMAIL is also loaded
- Documentation: mention JIRA_AUTH_TOKEN backward-compatible alias and
  JIRA_EMAIL requirement in SKILL.md files
- Error messages: mention both JIRA_API_TOKEN and JIRA_AUTH_TOKEN

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@aireilly aireilly force-pushed the fix/support-local-env-file branch from c323a7e to 39fd971 Compare May 3, 2026 12:10
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh`:
- Around line 20-43: The loader currently loads ~/.env first then the project
.env using _safe_load_env which only exports unset keys, causing ~/.env to win;
change the flow so project-local env overrides user env: either call
_safe_load_env on "$_project_root/.env" before loading ~/.env, or modify
_safe_load_env to accept an optional "override" flag so when invoked for
"$_project_root/.env" it will export and replace existing keys (but still avoid
clobbering truly pre-existing environment variables), referencing the
_safe_load_env function, the ~/.env load, and the "$_project_root/.env"
invocation to implement the fix.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 19af4fd6-c1f0-44cd-bffb-4b941697a0fa

📥 Commits

Reviewing files that changed from the base of the PR and between c323a7e and 39fd971.

📒 Files selected for processing (21)
  • .gitignore
  • plugins/docs-tools/.claude-plugin/plugin.json
  • plugins/docs-tools/README.md
  • plugins/docs-tools/agents/docs-planner.md
  • plugins/docs-tools/agents/docs-writer.md
  • plugins/docs-tools/agents/requirements-analyst.md
  • plugins/docs-tools/agents/requirements-discoverer.md
  • plugins/docs-tools/agents/technical-reviewer.md
  • plugins/docs-tools/skills/docs-orchestrator/SKILL.md
  • plugins/docs-tools/skills/docs-review-style/SKILL.md
  • plugins/docs-tools/skills/docs-review-technical/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-create-jira/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh
  • plugins/docs-tools/skills/docs-workflow-jira-ready/SKILL.md
  • plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh
  • plugins/docs-tools/skills/git-pr-reader/SKILL.md
  • plugins/docs-tools/skills/git-pr-reader/scripts/git_pr_reader.py
  • plugins/docs-tools/skills/jira-reader/SKILL.md
  • plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py
  • plugins/docs-tools/skills/jira-writer/SKILL.md
  • plugins/docs-tools/skills/jira-writer/scripts/jira_writer.py
✅ Files skipped from review due to trivial changes (12)
  • .gitignore
  • plugins/docs-tools/skills/docs-workflow-create-jira/SKILL.md
  • plugins/docs-tools/.claude-plugin/plugin.json
  • plugins/docs-tools/skills/docs-workflow-jira-ready/SKILL.md
  • plugins/docs-tools/agents/requirements-discoverer.md
  • plugins/docs-tools/skills/docs-orchestrator/SKILL.md
  • plugins/docs-tools/skills/docs-review-style/SKILL.md
  • plugins/docs-tools/agents/technical-reviewer.md
  • plugins/docs-tools/agents/docs-writer.md
  • plugins/docs-tools/skills/jira-writer/SKILL.md
  • plugins/docs-tools/skills/jira-reader/SKILL.md
  • plugins/docs-tools/agents/docs-planner.md
🚧 Files skipped from review as they are similar to previous changes (4)
  • plugins/docs-tools/skills/git-pr-reader/SKILL.md
  • plugins/docs-tools/agents/requirements-analyst.md
  • plugins/docs-tools/skills/jira-reader/scripts/jira_reader.py
  • plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh

Swap the shell script load order to match the Python scripts: project
.env first (local overrides), then ~/.env (global defaults). Since
_safe_load_env only sets unset keys, first-loaded wins.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh`:
- Around line 82-85: The script currently derives _project_root from SCRIPT_DIR,
which ties .env loading to the script repo; instead resolve the caller project
root from the current working directory and only fall back to the script
directory if that fails. Change the logic around _project_root so it first runs
git rev-parse --show-toplevel (or simply checks $PWD/.env) using the runtime
working directory (e.g. "$PWD") and call _safe_load_env with that path if
present, otherwise fall back to using SCRIPT_DIR-based resolution; update
references to _project_root, SCRIPT_DIR, and the _safe_load_env invocation in
jira-ready-check.sh accordingly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5483d219-d831-4fc8-bec7-c7910404f7ec

📥 Commits

Reviewing files that changed from the base of the PR and between 39fd971 and 2090a28.

📒 Files selected for processing (2)
  • plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh
  • plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh
🚧 Files skipped from review as they are similar to previous changes (1)
  • plugins/docs-tools/skills/docs-workflow-create-jira/scripts/create-jira-ticket.sh

Comment thread plugins/docs-tools/skills/docs-workflow-jira-ready/scripts/jira-ready-check.sh Outdated
aireilly added 2 commits May 4, 2026 09:35
jira-ready-check.sh now tries CWD's git root first for .env loading,
falling back to SCRIPT_DIR only if CWD is not in a git repo.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@aireilly aireilly merged commit 4651e72 into main May 4, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support local .env in addition to ~/.env

1 participant