Meta tags:
description=Treat settings documentation as two artifacts rather than one generated page, because compilers list... Tagged with python, documentation, devops, testing.;
keywords=python, documentation, devops, testing, software, coding, development, engineering, inclusive, community;

Headings (most frequently used words):

atlas, extract, settings, key, docs, lane, the, should, for, hand, write, secrets, restarts, and, blast, radius, dev, community, why, generated, env, go, stale, compile, versus, signature, artifact, numbered, workflow, tests, that, keep, honest, what, model, never, receive, limitations, who, not, use, this, approach, top, comments, more, from, avery, lin,

Text of the page (most frequently used words):
the (56), and (52), not (31), atlas (27), keys (26), key (26), path (25), that (21), for (19), rows (18), from (16), str (16), self (16), value (16), source (15), env (15), ast (15), model (13), json (13), name (13), dev (12), #secret (12), root (12), func (12), are (11), draft (11), production (11), example (11), node (11), isinstance (11), comment (10), signed (10), fullscreen (10), mode (10), import (10), none (10), def (10), keep (9), names (9), any (9), only (9), environ (9), documentation (8), can (8), does (8), docs (8), python (7), you (7), this (7), comments (7), those (7), sheet (7), signature (7), yaml (7), default (7), compile (7), settings (7), lineno (7), share (6), with (6), free (6), out (6), when (6), list (6), file (6), lane (6), class (6), enter (6), getenv (6), shape (6), blast (6), radius (6), args (6), resolved (6), human (5), may (5), hand (5), because (5), call (5), without (5), ownership (5), never (5), public (5), exit (5), smtp_host (5), get (5), row (5), unresolved_count (5), utf (5), encoding (5), settings_atlas (5), return (5), dict (5), line (5), stripped (5), val (5), community (4), 2026 (4), use (4), your (4), testing (4), against (4), unlabeled (4), table (4), same (4), skip (4), configuration (4), defaults (4), internal (4), extractor (4), secrets (4), last_verified (4), payments_webhook_secret (4), tmp_path (4), compile_atlas (4), dynamic (4), host (4), app (4), values (4), print (4), must (4), empty (4), files (4), restart (4), tree (4), parser (4), strip (4), visitor (4), attr (4), attribute (4), arg0 (4), rel (4), lines (4), whether (4), extract (4), create (3), date (3), software (3), open (3), code (3), facts (3), pages (3), devops (3), product (3), avery (3), lin (3), abuse (3), will (3), but (3), still (3), invent (3), treat (3), require (3), git (3), team (3), chat (3), should (3), workflow (3), operational (3), job (3), compiler (3), add (3), constructor (3), one (3), grouping (3), check (3), application (3), run (3), secret_class (3), settings_ownership (3), shapes (3), assert (3), write_text (3), prefix (3), mail (3), proposed (3), unresolved (3), part (3), document (3), than (3), cells (3), prose (3), signer (3), true (3), start (3), humans (3), fill (3), key_count (3), _add (3), prev (3), idx (3), copy (3), account (2), log (2), stay (2), grow (2), built (2), policy (2), conduct (2), about (2), drafted (2), tutorial (2), more (2), user (2), hide (2), become (2), post (2), via (2), report (2), templates (2), let (2), template (2), already (2), runbook (2), artifact (2), plus (2), paragraphs (2), server (2), option (2), output (2), then (2), review (2), written (2), repository (2), hosted (2), including (2), vendor (2), cannot (2), live (2), single (2), transcript (2), contract (2), drift (2), actually (2), misses (2), runtime (2), also (2), services (2), unless (2), second (2), often (2), stale (2), blurbs (2), which (2), input (2), feature (2), test (2), test_settings_atlas (2), set (2), outbound (2), extract_settings_atlas (2), pathlib (2), fixture (2), literal (2), split (2), monkeycode (2), into (2), window (2), usually (2), need (2), signatures (2), rather (2), cell (2), render (2), both (2), added (2), removed (2), fail (2), matching (2), emit (2), credential (2), blast_radius (2), restart_required (2), unset_means (2), production_default (2), smtp (2), copied (2), contains (2), main (2), type (2), add_argument (2), argparse (2), len (2), parse_env_example (2), extend (2), elif (2), parse_python (2), continue (2), skip_dirs (2), relative_to (2), append (2), startswith (2), splitlines (2), read_text (2), envvisitor (2), parse (2), generic_visit (2), else (2), constant (2), _comment (2), int (2), venv (2), below (2), reads (2), them (2), last (2), operator (2), owner (2), merge (2), rule (2), truth (2), two (2), while (2), meaning (2), tell (2), they (2), missing (2), generated (2), write (2), restarts (2), link (2), search (2), place, where, coders, their, careers, made, love, 2016, ruby, rails, powers, other, inclusive, communities, forem, terms, privacy, mlh, shop, postgres, database, contact, showcase, organization, accounts, advertise, help, education, tracks, videos, challenges, home, space, discuss, development, manage, career, escalation, troubleshooting, unsourced, limits, gate, changelog, narratives, owned, release, ledger, aug, joined, singapore, location, frontend, developer, crafting, beautiful, experiences, follow, further, actions, consider, blocking, person, reporting, confirm, child, well, sure, want, hidden, visible, permalink, dismiss, preview, submit, quickly, answer, faqs, store, snippets, trusted, personal, subscribe, top, teams, benefit, generating, api, reviewed, seeing, guide, pull, requests, original, pair, try, beside, would, demand, allowed, endpoints, alone, reveal, layout, themselves, classified, even, wants, stand, cases, cmdb, alarm, who, approach, classify, vulnerability, impact, rotate, prove, uses, controls, outside, surface, three, spreadsheet, solves, problem, adds, ceremony, reducing, risk, read, config, loaders, referenced, shell, charts, helm, non, schema, fluent, wrong, time, rot, enforced, returns, narrative, limitations, send, happen, credentials, sample, jwt, strings, real, hostnames, locate, private, network, ask, infer, pci, pii, flag, service, session, another, rename, identifier, grep, text, contradicts, wins, becomes, cleanup, ticket, user_token, what, receive, assertion, every, exists, quality, unit, pipeline, pytest, beta, flag_, conf, mkdir, test_literal_and_unresolved_keys, claim, asserts, found, contributes, tests, honest, editor, useful, disclosure, article, was, prepared, outreach, offers, access, step, putting, tools, title, upload, paste, back, reject, dates, older, chooses, ninety, days, starting, shorter, age, small, renderer, show, unsigned, paraphrases, come, authored, deletion, orphan, dead, diff, rises, note, hole, point, packages, exclude, sealed, maps, freeze, inputs, numbered, payments, oncall, payment, confirmation, webhook, handler, disabled, null, sre, all, tenants, process, refuses, mailer, generate, starts, except, remaining, columns, fixtures, settings_app, load, directory, holds, __main__, __name__, wrote, indent, dumps, resolve, parse_args, description, argumentparser, sum, sorted, suffix, parts, rglob, enumerate, visit, slice, subscript, visit_subscript, visit_call, 160, __init__, nodevisitor, __pycache__, node_modules, typing, annotations, __future__, scanner, usr, bin, python3, script, local, walks, records, classifications, such, emitted, decide, checks, iso, freshness, verified, required, blindly, unset, means, block, publish, security, discard, keeps, yes, excerpt, suggested, group, overwrites, each, comparison, apply, before, sees, quietly, version, control, refuse, during, generation, locations, nearby, whose, markdown, compiled, has, longer, versus, cheap, expensive, absent, says, change, requires, rolling, overrides, gaps, defects, owners, prompts, guess, guides, memory, instead, current, readers, repositories, flags, timeout, knobs, urls, across, index, reviewers, approve, documents, omits, new, ones, week, failure, tone, why, artifacts, page, compilers, own, static, pass, over, calls, fields, complete, until, someone, signs, models, based, four, posted, sep, mastodon, facebook, linkedin, clipboard, pick, gem, boost, save, jump, fire, raised, hands, exploding, head, unicorn, like, reaction, close, powered, algolia, navigation, menu, content,

Text of the page (random words):
extract a settings key atlas for docs hand write secrets restarts and blast radius dev community skip to content navigation menu search powered by algolia search log in create account dev community close add reaction like unicorn exploding head raised hands fire jump to comments save boost pick as gem more copy link copy link copied to clipboard share to x share to linkedin share to facebook share to mastodon share post via report abuse avery lin posted on sep 18 extract a settings key atlas for docs hand write secrets restarts and blast radius documentation python testing devops treat settings documentation as two artifacts rather than one generated page because compilers list keys while humans still own production meaning a static pass over getenv calls settings fields and env example lines can emit a complete atlas of names that atlas is not a contract until someone signs secret class production default restart need and blast radius models may draft grouping and comment based blurbs from the atlas but they must not fill those four signed cells why generated env docs go stale chat written configuration guides drift because they start from memory of names instead of a parse of current readers repositories grow feature flags timeout knobs and vendor urls across services without a single index reviewers then approve prose that still documents removed keys or omits new ones added last week the failure is not tone it is missing compile input and missing ownership of operational facts public names are usually cheap to extract while operational meaning is expensive and often absent from source a comment that says smtp host does not tell on call whether a change requires a rolling restart a default in a constructor does not tell whether production overrides it or whether the value is a credential treat those gaps as documentation defects with owners not as prompts for a model to guess compile lane versus signature lane keep two files in version control and refuse to merge them during generation the compile lane is a json atlas of keys the tree actually reads plus source locations and nearby comments the signature lane is a yaml ownership sheet whose cells a human must fill including secret class and blast radius a docs job may render both into markdown but it must fail if a compiled key has no signed row or if a signed row names a key the atlas no longer contains the table below is the rule set for this workflow not a product comparison apply it before any model sees the atlas so draft prose cannot quietly become production truth cell source of truth model may draft merge rule key name file line call shape ast env example no compiler overwrites on each run comment excerpt suggested group source comments yes as unlabeled draft discard unless a human keeps it secret class public internal secret security owner no block docs publish if empty production default unset means runtime owner no never copy constructor defaults blindly restart required operator no signature file only blast radius operator no signature file only last verified date signer human no ci checks iso date freshness artifact extract a settings key atlas the script below is a proposed local compiler it walks python files records os getenv os environ get and os environ with literal keys and also reads env example it does not open env does not print values and does not invent secret classifications dynamic keys such as os environ prefix name are emitted as unresolved rows so humans can decide whether to document them by hand usr bin env python3 compile a settings key atlas proposed example not a production scanner from __future__ import annotations import argparse import ast import json from pathlib import path from typing import any skip_dirs git venv venv node_modules __pycache__ class envvisitor ast nodevisitor def __init__ self rel str none self rel rel self rows list dict str any def _comment self lineno int source str str lines source splitlines idx lineno 2 if 0 idx len lines prev lines idx strip if prev startswith return prev 1 strip 160 return def _add self key str none lineno int shape str source str none self rows append key key file self rel line lineno shape shape comment self _comment lineno source resolved key is not none def visit_call self node ast call none func node func name if isinstance func ast attribute and isinstance func value ast attribute if isinstance func value value ast name and func value value id os and func value attr environ and func attr get name os environ get elif isinstance func ast attribute and isinstance func value ast name if func value id os and func attr getenv name os getenv if name and node args arg0 node args 0 key arg0 value if isinstance arg0 ast constant and isinstance arg0 value str else none self _add key node lineno name self source self generic_visit node def visit_subscript self node ast subscript none val node value if isinstance val ast attribute and isinstance val value ast name and val value id os and val attr environ sl node slice key sl value if isinstance sl ast constant and isinstance sl value str else none self _add key node lineno os environ self source self generic_visit node def parse_python path path root path list dict str any source path read_text encoding utf 8 tree ast parse source visitor envvisitor str path relative_to root visitor source source visitor visit tree return visitor rows def parse_env_example path path root path list dict str any rows for i line in enumerate path read_text encoding utf 8 splitlines start 1 stripped line strip if not stripped or stripped startswith or not in stripped continue key stripped split 1 0 strip if key rows append key key file str path relative_to root line i shape env example comment resolved true return rows def compile_atlas root path dict str any rows list dict str any for path in root rglob if any part in skip_dirs for part in path parts continue if path suffix py rows extend parse_python path root elif path name env example rows extend parse_env_example path root resolved r for r in rows if r resolved keys sorted r key for r in resolved if r key return root str root key_count len keys unresolved_count sum 1 for r in rows if not r resolved keys keys rows rows def main none parser argparse argumentparser description compile a settings key atlas parser add_argument root type path parser add_argument out type path default path settings_atlas json args parser parse_args atlas compile_atlas args root resolve args out write_text json dumps atlas indent 2 n encoding utf 8 print f wrote args out keys atlas key_count unresolved atlas unresolved_count if __name__ __main__ main enter fullscreen mode exit fullscreen mode run it against a fixture tree that contains names only never against a directory that holds live secret files python extract_settings_atlas py fixtures settings_app out settings_atlas json python c import json d json load open settings_atlas json print d key_count d unresolved_count enter fullscreen mode exit fullscreen mode a matching ownership sheet starts empty except for key names copied from the atlas humans fill the remaining columns in review not in a chat transcript settings_ownership yaml signature lane do not generate values keys smtp_host secret_class public production_default smtp internal example unset_means application refuses to start mailer restart_required true blast_radius outbound mail for all tenants on this process signer sre mail last_verified 2026 09 18 payments_webhook_secret secret_class secret production_default null unset_means webhook handler disabled restart_required true blast_radius payment confirmation path only signer payments oncall last_verified 2026 09 18 enter fullscreen mode exit fullscreen mode numbered workflow freeze the compile inputs point the extractor at application packages and env example only exclude env sealed secrets and ci credential maps so values never enter the atlas json emit settings_atlas json in ci fail the job when unresolved_count rises without a matching note in the ownership sheet because dynamic keys are a documentation hole diff keys against settings_ownership yaml added keys require empty signed rows removed keys require deletion of signed rows do not keep orphan signatures that document dead configuration draft only unlabeled prose from the atlas grouping paragraphs and comment paraphrases may come from a model secret class production default restart and blast radius stay human authored render docs from both files a small template can print a table of keys with signed cells the renderer must show unsigned rather than invent a default when a cell is empty age check signatures reject last_verified dates older than a window your team chooses ninety days is a starting policy for public keys secret rows usually need a shorter window if a hosted editor is useful for the draft table keep the same split disclosure this article was prepared as part of monkeycode s product outreach monkeycode offers free model access and a free server option which can host the extractor and the unlabeled draft step without putting those tools in the title of the document upload settings_atlas json only never env and paste signed yaml back into git by hand so production defaults are not model output tests that keep the atlas honest the test is a proposed fixture check not a claim about a production repository it asserts that literal keys are found that dynamic keys are unresolved and that env example contributes names without values test_settings_atlas py from pathlib import path from extract_settings_atlas import compile_atlas def test_literal_and_unresolved_keys tmp_path path none app tmp_path app app mkdir app conf py write_text import os n outbound mail host n host os getenv smtp_host n secret os environ get payments_webhook_secret n prefix flag_ n dynamic os environ prefix beta n encoding utf 8 tmp_path env example write_text smtp_host n payments_webhook_secret n encoding utf 8 atlas compile_atlas tmp_path assert set atlas keys smtp_host payments_webhook_secret assert atlas unresolved_count 1 shapes row shape for row in atlas rows if row get key smtp_host assert os getenv in shapes and env example in shapes enter fullscreen mode exit fullscreen mode pytest q test_settings_atlas py enter fullscreen mode exit fullscreen mode add a second ci assertion that every atlas key exists in settings_ownership yaml and that secret_class is one of public internal or secret that check is documentation quality not an application unit test and it should run on the docs pipeline what the model should never receive do not send constructor defaults that happen to be credentials sample jwt strings or real hostnames that locate a private network do not ask a model to infer pci or pii class from a key name because user_token can be a ui feature flag in one service and a session secret in another do not let draft grouping rename keys the atlas name is the identifier on call will grep when comment text contradicts the signed sheet the sheet wins and the comment becomes a code cleanup ticket limitations this compiler misses keys built at runtime keys read from yaml json config loaders and keys referenced only in shell charts or helm templates it also misses non python services unless you add a second extractor with the same json schema comments are often stale so draft blurbs can be fluent and wrong at the same time the ownership sheet can rot if last_verified is not enforced which returns the team to narrative docs with no compile input the workflow does not classify vulnerability impact does not rotate secrets and does not prove that production actually uses the signed default those are operational controls outside the documentation job if your configuration surface is three keys a spreadsheet already solves the problem and the atlas adds ceremony without reducing risk who should not use this approach skip it when the repository is not allowed to list configuration names on any hosted model including free model endpoints because names alone can reveal vendor layout skip it when production defaults are themselves classified and cannot live in git even in a signed yaml file skip it when the team wants a single chat transcript to stand in for an on call contract in those cases keep an internal cmdb as the signature lane and use the extractor only as a drift alarm teams that benefit are those already generating api or runbook pages from reviewed facts and those that keep seeing env guide pull requests that invent keys the original artifact is the atlas plus sheet pair not the draft paragraphs if you try the free model draft path on a free server option treat that output as unlabeled comments beside the table then require the same signature review you would demand for a hand written runbook top comments 0 subscribe personal trusted user create template templates let you quickly answer faqs or store snippets for re use submit preview dismiss code of conduct report abuse are you sure you want to hide this comment it will become hidden in your post but will still be visible via the comment s permalink hide child comments as well confirm for further actions you may consider blocking this person and or reporting abuse avery lin follow frontend developer crafting beautiful user experiences location singapore joined aug 6 2026 more from avery lin gate changelog narratives against a human owned release ledger documentation testing python devops keep unsourced limits out of model drafted product pages python testing ai tutorial keep escalation facts out of model drafted troubleshooting pages documentation tutorial testing devops dev community a space to discuss and keep up software development and manage your software career home dev challenges dev videos dev education tracks dev help advertise on dev organization accounts dev showcase about contact free postgres database dev shop mlh code of conduct privacy policy terms of use built on forem the open source software that powers dev and other inclusive communities made with love and ruby on rails dev community 2016 2026 we re a place where coders share stay up to date and grow their careers log in create account