Core Service — Sanitization¶

What was removed, modified, and added when preparing ask-core-service-development for deployment to gitlab.cl1.sq4.aegis.internal/modgpt/ask-core-service. Every change is specific to this repo — for the generic process see Repo Sanitization.

Summary

Action	Items	Reason
Removed	11 categories of files	Not needed by the cluster; expose internal/cloud infrastructure
Modified	`helm/Chart.yaml`	Dependency repo URL was a placeholder
Modified	`helm/values.yaml`	Duplicate `postgresInit` key removed (YAML bug — last key wins)
Added	`helm/templates/job-migrations.yaml`	Migration PreSync Job (not in upstream chart)
Added	`helm/environments/values-ai71-uaen-prod-modgpt.yaml`	Staging environment overlay (replaces all 6 prod env files)

Files removed

Source code¶

Path	Why
`src/`	Python application source — baked into the Docker image. The cluster runs the image, never touches the source. Exposing it would leak business logic.
`tests/`	pytest test suite — no meaning in a deployment repo.
`alembic/` + `alembic.ini`	DB migration scripts — `Dockerfile` copies these into the image (`COPY alembic/ ./alembic/`). They are available inside the container; the cluster repo does not need the raw files.

Python packaging¶

Path	Why
`pyproject.toml`	Python package metadata and build config. The image is already built; nobody re-installs packages from the cluster repo.
`uv.lock`	Dependency lock file — paired with `pyproject.toml`, same reasoning.
`requirements-docs.txt`	MkDocs build requirements — for developer documentation only.

Developer tooling¶

Path	Why
`.pre-commit-config.yaml`	Git pre-commit hooks for local development — irrelevant in a deployment repo.
`PRE_COMMIT_SETUP.md`	Pre-commit setup instructions — paired with above.
`.coveragerc`	pytest-coverage configuration — test tooling.
`.tool-versions`	`asdf` version pins (Python, Node, etc.) for local dev environments.
`templates/COMMITIZEN_CHANGELOG.md.j2`	Commitizen changelog template for the dev release process.

Application documentation¶

Path	Why
`docs/`	MkDocs source for the application's own developer documentation.
`site/`	Pre-built MkDocs HTML output (~10 MB of static files). Pure noise in a deployment repo.
`mkdocs.yml`	MkDocs config paired with the above.
`README.md`	Kept — provides useful context about what the service does.
`CHANGELOG.md`	Kept — useful for tracking what version is being deployed.

CI/CD pipelines and ADO scripts¶

Path	Why
`security/autoupdate-pipeline.yml`	Azure DevOps pipeline — runs dependency auto-updates. Irrelevant; this environment has no ADO.
`security/gitleaks-pipeline.yml`	Azure DevOps secret-scanning pipeline.
`security/security-pipeline.yml`	Azure DevOps SAST/DAST pipeline.
`security/zap-framework.yml`	OWASP ZAP penetration test framework config for ADO.
`security/README.md`	Documents the ADO security pipeline structure.
`scripts/download_env_from_ado.sh`	High risk — downloads secrets from Azure DevOps variable groups. Leaks ADO org name, project path, and variable group names.
`scripts/upload_env_to_ado.sh`	Writes secrets back to ADO variable groups. Same concerns.
`scripts/fetch_sample_dump.py`	Fetches a production DB dump for local testing. Exposes prod DB access pattern.
`scripts/publish_gitlab_release.py`	Publishes releases to the upstream `ai71` GitLab.com org. Leaks internal release pipeline.
`scripts/release_config_changes.py`	ADO release automation — same concern.
`scripts/run_integration_tests.sh`	Integration test runner referencing internal service endpoints.
`scripts/test_bulk_ops_e2e.sh`	End-to-end test script — dev tooling.

Scripts kept

scripts/apply_migrations.sh, scripts/init_db.sh, scripts/make_migrations.sh, scripts/verify_migrations.py, scripts/validate_env.py, scripts/drop_db.sh — kept as they are relevant DB bootstrap helpers (harmless if included, useful for ops reference).

Internal metadata — highest risk files¶

Path	Risk	Why removed
`.cruft.json`	🔴 HIGH	Contains the full ADO SSH URL `git@ssh.dev.azure.com:v3/VentureOne/AI71/ai71_python_template`, internal author name (`Saleem Hamo`), author email (`saleem.hamo@ai71.ai`), ADO project structure, and the template commit SHA. Exposes internal org/team identity.
`sonar-project.properties`	🟡 Medium	Contains `sonar.organization=ai71`, `sonar.projectKey=ai71_core-service`, ADO branch name. Exposes internal Sonar org.
`.claude/settings.local.json`	🟡 Medium	Claude Code AI assistant settings — internal tooling config.
`CLAUDE.md` (repo root)	🟡 Medium	Internal AI assistant notes about the codebase, including developer context.
`.env.example`	🟡 Medium	Key names are safe (`@format {env[...]}` references only), but surrounding comments and structure reveal the complete secret schema. Removed to avoid a roadmap of what secrets to look for.

Helm environment files¶

All 6 production environment files removed entirely:

File	Sensitive content
`values-ai71-uaen-prod-mufti.yaml`	Azure Postgres hostname, Azure ACR image refs, Azure Redis hostname (`…redis.azure.net`), Azure storage account name (`ai71uaenprodmufticore01`), production domains (`sso.ask.mufti.ai71services.ai`), real org IDs and superadmin email, Azure ingress class
`values-ai71-uaen-stg-ask71.yaml`	Azure Postgres hostname, staging domain names, Azure CDN URL, Azure storage account, ACR refs
`values-ai71-uaen-dev-ask71.yaml`	Azure dev environment endpoints
`values-ai71-mec1-prod-mufti.yaml`	MEC region production Azure endpoints
`values-ai71-mec1-stg-ask71.yaml`	MEC region staging endpoints
`values-ai71-pp-auh1-prod-ask.yaml`	Abu Dhabi production endpoints

These reveal the full cloud infrastructure topology (hosting regions, DB naming conventions, storage account naming, CDN setup). Removed completely — replaced by values-ai71-uaen-prod-modgpt.yaml.

Files modified

`helm/Chart.yaml` — dependency repository URL¶

The upstream chart ships with a placeholder for the zitadel subchart repository:

# BEFORE (upstream — placeholder, non-functional)
dependencies:
  - name: zitadel
    version: "1.0.1"
    repository: "oci://your-internal-registry.example.com/devops-helm-charts"
    condition: zitadel.enabled

# AFTER (air-gap — points to our internal OCI registry)
dependencies:
  - name: zitadel
    version: "1.0.1"
    repository: "oci://harbor.cl1.sq4.aegis.internal/modgpt/charts"
    condition: zitadel.enabled

This change is required before helm dependency build can vendor the subchart. The upstream chart's AIRGAP comment explicitly documents this step — it was designed for this exact substitution.

`helm/values.yaml` — duplicate `postgresInit` key removed¶

values.yaml defines postgresInit: twice at the top level. Go YAML silently takes the last key, making the comprehensive first block (connection, db, secrets, ArgoCD hooks) dead code. The bare duplicate postgresInit: enabled: false block at the bottom of the file is removed in this environment version so the full block is the canonical definition.

`helm/CLAUDE.md` — removed¶

Internal AI assistant notes inside the chart directory. Removed.

Files added

Uncommitted in dev repo — include in air-gap push

helm/templates/job-migrations.yaml and the migrations: block in helm/values.yaml are working-tree changes in the dev repo (not yet committed to main). They are NOT in the committed helm/ tree of ask-core-service-development. When preparing the air-gap repo, either commit these to the dev repo first (git add helm/templates/job-migrations.yaml helm/values.yaml && git commit) or ensure they are included directly in the sanitized air-gap repo push.

`helm/templates/job-migrations.yaml` — new¶

The upstream chart has no migration Job. The CMD in the Dockerfile starts uvicorn only — alembic upgrade head must be triggered explicitly.

Added a PreSync Helm Job with a toggle flag:

# helm/templates/job-migrations.yaml
{{- if .Values.migrations.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "core-service.fullname" . }}-migrations
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/sync-wave: "0"
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
spec:
  template:
    spec:
      containers:
        - name: alembic-upgrade
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          command: [ "alembic", "upgrade", "head" ]
          envFrom: [ secretRef: { name: core-service-secret } ]
          # + configToml volumeMount
{{- end }}

Toggle in values.yaml (default false — safe for local dev):

migrations:
  enabled: false

Enabled to true in values-ai71-uaen-prod-modgpt.yaml so every ArgoCD sync runs migrations automatically.

`helm/environments/values-ai71-uaen-prod-modgpt.yaml` — new¶

Replaces all 6 upstream environment files with a single production overlay for the air-gap environment. Contains no secrets (all from Vault via VSO). See Config Updates for the full side-by-side comparison.

➡️ Related: Discovery · Air-Gap Alignment · Config Updates · Generic Sanitization Process