From 995892a17f3e47e6949eae6baf749c35309af361 Mon Sep 17 00:00:00 2001
From: ciagent <ciagent@orca.local>
Date: Wed, 3 Jun 2026 20:39:15 +0000
Subject: [PATCH] =?UTF-8?q?fix(security):=20untrack=20.env=20=E2=80=94=20s?=
 =?UTF-8?q?ecret=20in=20history,=20rotate=20forward?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The .env file (containing GITEA_TOKEN) was committed in 0cba1aa during
P00 and remained tracked in git history despite the leak. The
.gitignore addition in 477b08c (P07) prevents future re-tracking but
does not untrack a file already in the index.

This commit runs 'git rm --cached .env' to remove the file from the
index while preserving the working-tree copy (which now contains the
rotated token post-P07-verify). The secret remains in git history at
0cba1aa and must be scrubbed by a human (see PHASE7_SECURITY_AUDIT.md
for the full remediation plan, including optional git-filter-repo
history rewrite).

Combined with 477b08c, this commit closes the forward-fix loop:
- .env is now ignored (.gitignore)
- .env is no longer tracked (this commit)
- New tokens in .env will not be committed accidentally
- The historical leak is documented for human remediation

---ci---
project: orca
phase: 7
milestone: v0.1
status: ship
version: v0.1.7
requirements:
  covered: [REQ-007]
  partial: []
---/ci---
---
 .env | 2 --
 1 file changed, 2 deletions(-)
 delete mode 100644 .env

diff --git a/.env b/.env
deleted file mode 100644
index 7fc9488..0000000
--- a/.env
+++ /dev/null
@@ -1,2 +0,0 @@
-GITEA_TOKEN=795e2f875dcd23dff830fab8301ec52e4c9d67aa
-GITEA_USER=cloudinit-bot