fix: pass paths visible in git history

[dmzoneill]

group_vars/all.yml exposes secret store structure. Consider runtime fetch.

[github-actions]

Based on my review, the issue mentions group_vars/all.yml exposing secret store structure. This appears to be related to Ansible configuration where paths to secret stores (like HashiCorp Vault, AWS Secrets Manager, etc.) may be hardcoded in the file.

Recommendation

Instead of storing secret paths in group_vars/all.yml which gets committed to git history, you should:

1. Remove sensitive path information from git history using git filter-branch or BFG Repo-Cleaner

2. Use runtime environment variables to pass secret store paths:

   # group_vars/all.yml - safe version
   secret_store_path: "{{ lookup('env', 'SECRET_STORE_PATH') }}"

3. Or use ansible-vault to encrypt the file:

   ansible-vault encrypt group_vars/all.yml

4. For CI/CD, set environment variables in GitHub Actions secrets rather than in files:

   env:
     SECRET_STORE_PATH: ${{ secrets.SECRET_STORE_PATH }}

The current ai-responder.py already follows this pattern correctly by using os.getenv() for sensitive values like GITHUB_TOKEN, TELEGRAM_BOT_TOKEN, etc., rather than hardcoding them.

Would you like me to help implement any of these solutions?

[dmzoneill]

Accepted: pass paths in group_vars are organizational structure, not secrets. Knowing pass paths doesn't enable access without GPG key.