Workflows
Validation & Review
Define configuration contracts, find missing or invalid values, and scan the repository for hard-coded secrets and environment drift.
Validation and Review differ
Validation checks environment values against an explicit schema. Review inspects repository hygiene, including hard-coded secrets and environment drift. Run both: a value can satisfy its schema while the same credential is accidentally embedded in source code.
Validation rules
The Validation page lists project rules from .ghostable/schema.yaml and shows diagnostics for the current environment. Add rules for keys whose absence or shape should block a release.
Supported rules are defined by the bundled CLI and include common contracts such as:
-
required - Require the key to exist and contain an acceptable value.
-
format / pattern - Require a value to match an expected shape.
-
allowed values - Restrict a key to an approved set.
-
different_from - Require the value to differ from another environment.
-
unique - Require an environment-specific value where reuse would be unsafe.
Use the CLI Validation reference for the current rule grammar and edge cases. Desktop edits the same schema.
Global rules and environment overrides make missing or invalid configuration explicit.
Environment overrides
Global rules apply across environments. Environment overrides narrow or adjust a rule for one target, such as enforcing a production-only hostname or allowing a development placeholder.
Prefer a clear global contract plus small overrides. Duplicating the entire schema per environment makes drift harder to review.
Review scanning
The Review page runs repository checks through the CLI. Hard-coded secret findings identify likely credentials in tracked or working-tree source. Environment checks surface keys that are missing, unexpectedly reused, or inconsistent with project expectations.
Review findings are evidence, not automatic rotation. If a real credential reached source or Git history, remove it from code, rotate it at the provider, update Ghostable, and assess the history separately.
Review combines ENV diagnostics, hard-coded secret scanning, and hygiene findings.
Scan levels and ignored paths
-
relaxed - Lower-noise checks for repositories with many fixtures or generated patterns.
-
standard - The default balance for normal application repositories.
-
strict - Broader detection when false positives are acceptable during a security-focused review.
Ignored paths are project policy. Keep the list narrow and review every addition. Generated directories and encrypted Ghostable value paths are reasonable defaults; application source should not be excluded merely to make a finding disappear.
Before committing
- Resolve blocking validation errors for each changed environment.
- Run Review at the project's configured scan level.
- Investigate new findings and document intentional exceptions through project policy.
- Inspect the Git diff for schema, scan settings, ignored paths, and encrypted state.
- Commit the smallest coherent change.