Skip symlinked env discovery inputs

Author: homanp

pithos/env_discovery.py

@@ -201,7 +201,7 @@ def _env_example_hints(repo: Path, errors: list[str]) -> list[EnvHint]:
     hints: list[EnvHint] = []
     for name in ENV_EXAMPLE_NAMES:
         path = repo / name
-        if not path.exists():
+        if _has_symlink_part(path, repo) or not path.exists():
             continue
         rel = _rel(path, repo)
         try:
@@ -220,10 +220,12 @@ def _env_example_hints(repo: Path, errors: list[str]) -> list[EnvHint]:
 
 def _github_workflow_hints(repo: Path, errors: list[str]) -> list[EnvHint]:
     workflows = repo / ".github" / "workflows"
-    if not workflows.is_dir():
+    if _has_symlink_part(workflows, repo) or not workflows.is_dir():
         return []
     hints: list[EnvHint] = []
     for path in sorted([*workflows.glob("*.yml"), *workflows.glob("*.yaml")]):
+        if _has_symlink_part(path, repo):
+            continue
         rel = _rel(path, repo)
         try:
             text = path.read_text(encoding="utf-8", errors="replace")
@@ -287,11 +289,12 @@ def _source_hints(repo: Path, errors: list[str]) -> tuple[list[EnvHint], int, in
 
 def _source_paths(repo: Path) -> Iterable[Path]:
     for path in repo.rglob("*"):
-        if not path.is_file() or path.suffix not in SOURCE_EXTENSIONS:
+        rel_parts = path.relative_to(repo).parts
+        if any(part in SKIP_DIRS or part.startswith(".git") for part in rel_parts):
             continue
-        if any(
-            part in SKIP_DIRS or part.startswith(".git") for part in path.relative_to(repo).parts
-        ):
+        if _has_symlink_part(path, repo):
+            continue
+        if not path.is_file() or path.suffix not in SOURCE_EXTENSIONS:
             continue
         yield path
 
@@ -326,6 +329,19 @@ def _dedupe_hints(hints: list[EnvHint]) -> list[EnvHint]:
     return out
 
 
+def _has_symlink_part(path: Path, repo: Path) -> bool:
+    try:
+        rel_parts = path.relative_to(repo).parts
+    except ValueError:
+        return True
+    current = repo
+    for part in rel_parts:
+        current = current / part
+        if current.is_symlink():
+            return True
+    return False
+
+
 def _rel(path: Path, repo: Path) -> str:
     try:
         return path.relative_to(repo).as_posix()

tests/test_env_discovery.py

@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 """Coverage for deterministic runtime env discovery."""
 
+import pytest
+
 from pithos.env_discovery import collect_env_hints, env_names_from_examples
 
 
@@ -77,3 +79,58 @@ def test_collect_env_hints_ignores_skipped_directories(tmp_path):
     report = collect_env_hints(repo)
 
     assert "PITHOS_TEST_DEPENDENCY_SECRET" not in report.required_names()
+
+
+def test_collect_env_hints_ignores_symlinked_inputs(tmp_path):
+    repo = tmp_path / "app"
+    repo.mkdir()
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    outside_env = outside / "external.env"
+    outside_env.write_text("PITHOS_TEST_OUTSIDE_EXAMPLE=value\n", encoding="utf-8")
+    outside_workflow = outside / "workflow.yml"
+    outside_workflow.write_text(
+        "env:\n  PITHOS_TEST_OUTSIDE_WORKFLOW: ${{ secrets.PITHOS_TEST_OUTSIDE_WORKFLOW }}\n",
+        encoding="utf-8",
+    )
+    outside_source = outside / "external.py"
+    outside_source.write_text(
+        'import os\nsecret = os.getenv("PITHOS_TEST_OUTSIDE_SOURCE")\n',
+        encoding="utf-8",
+    )
+    try:
+        (repo / ".env.example").symlink_to(outside_env)
+        workflows = repo / ".github" / "workflows"
+        workflows.mkdir(parents=True)
+        (workflows / "ci.yml").symlink_to(outside_workflow)
+        (repo / "linked.py").symlink_to(outside_source)
+    except OSError as e:
+        pytest.skip(f"symlinks unavailable: {e}")
+
+    report = collect_env_hints(repo)
+
+    assert "PITHOS_TEST_OUTSIDE_EXAMPLE" not in report.observed_names()
+    assert "PITHOS_TEST_OUTSIDE_WORKFLOW" not in report.observed_names()
+    assert "PITHOS_TEST_OUTSIDE_SOURCE" not in report.observed_names()
+    assert env_names_from_examples(repo) == []
+
+
+def test_collect_env_hints_ignores_symlinked_workflow_directory(tmp_path):
+    repo = tmp_path / "app"
+    repo.mkdir()
+    outside_workflows = tmp_path / "outside-workflows"
+    outside_workflows.mkdir()
+    (outside_workflows / "ci.yml").write_text(
+        "env:\n  PITHOS_TEST_OUTSIDE_WORKFLOW_DIR: value\n",
+        encoding="utf-8",
+    )
+    try:
+        github_dir = repo / ".github"
+        github_dir.mkdir()
+        (github_dir / "workflows").symlink_to(outside_workflows, target_is_directory=True)
+    except OSError as e:
+        pytest.skip(f"symlinks unavailable: {e}")
+
+    report = collect_env_hints(repo)
+
+    assert "PITHOS_TEST_OUTSIDE_WORKFLOW_DIR" not in report.observed_names()