Tighten CI .env enforcement and align identity-scan wording

[Copilot]

The linked review comment called out a mismatch in CI: the workflow only blocked backend/.env, while repo policy prohibits committing either app .env file. The adjacent identity-scan comment also claimed .env files were scanned even though that step does not include them.

• CI guardrails

  • Extend the .env commit check to fail for both backend/.env and frontend/.env.
  • Update the success message to reflect both enforced paths.

• Workflow comment accuracy

  • Narrow the identity-leak step comment so it describes the files actually scanned: shipped source, public HTML, and dev plugins.

• Result

  • CI policy and workflow messaging now match the repository’s actual .env rules.

- name: Check .env not committed
  run: |
    if [ -f "backend/.env" ]; then
      echo "::error::backend/.env should not be committed"
      exit 1
    fi
    if [ -f "frontend/.env" ]; then
      echo "::error::frontend/.env should not be committed"
      exit 1
    fi
    echo "✅ backend/.env and frontend/.env are not committed"

[djkingy79-yo]

@copilot resolve the merge conflicts in this pull request

[djkingy79-yo]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in 9981f3c.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.