Method checkEnvironmentVariables

pkg/compose/publish.go:428–451

checkEnvironmentVariables walks every compose file that will be serialized into the OCI artifact (the top-level files plus any local extends parents) and prompts the user to confirm before publishing: 1. service env_file declarations and literal environment values whose key name looks sensitive (pa

(ctx context.Context, project *types.Project, options api.PublishOptions)

// in the published YAML and don't leak the resolved value; the keyword
// detector's value regex skips them automatically.
func (s *composeService) checkEnvironmentVariables(ctx context.Context, project *types.Project, options api.PublishOptions) error {
	if len(project.ComposeFiles) == 0 {
		return nil
	}

	findings, err := collectEnvCheckFindings(ctx, project)
	if err != nil {
		return err
	}

	if !options.WithEnvironment && findings.hasEnvFinding() {
		if err := s.confirmOrCancel(buildEnvPromptMessage(findings.services)); err != nil {
			return err
		}
	}

	if len(findings.configsLiteralContent) > 0 {
		if err := s.confirmOrCancel(buildConfigContentPromptMessage(findings.configsLiteralContent)); err != nil {
			return err
		}
	}

	return nil
}

// confirmOrCancel runs an interactive yes/no prompt and returns:
//   - the prompt's error verbatim, if it failed;