Catching config drift before it breaks prod

Description and use

Conflint detects mismatches between code‑read environment variables and their definitions in config sources, preventing runtime failures.

Problem

Environment variables defined in code are missing or misconfigured in deployment, causing runtime failures.

Outcome

Conflint identified three issues in 7 ms: a committed secret, a missing required variable, and a typo causing drift. Fixing these prevented a production crash.

Workflow

• Install conflint via pip
• Run confl check to lint the project
• Review reported errors and warnings
• Add missing DATABASE_URL to .env
• Fix typo DATABSE_URL to DATABASE_URL
• Move real secrets to a secrets manager
• Run confl sync to regenerate .env.example
• Integrate conflint into CI with GitHub Action or pre-commit hook
• Commit changes and re-run CI

Evidence

Running confl check gives you: ... CL004 error: 'API_KEY' looks like a committed secret in dotenv:1 hint: Move real secrets to a secrets manager; keep placeholders in .env.example app.py:3:16 CL001 error: 'DATABASE_URL' is read in code but not defined in any configuration source:3 hint: Add it to your .env (then run confl sync to refresh .env.example) app.py:5:13 CL001 warning: 'REDIS_URL' is read in code but not defined in any configuration source:5 hint: Add it to your .env (then run confl sync to refresh .env.example) 2 files checked - 2 errors, 3 warnings, 0 infos

Source

It's early (v0.1.2, MIT). The rule set and source coverage are opinionated and evolving.

Source

GitHub Action (inline PR annotations): - name: Lint configuration uses: conflint/[email protected] with: reporter: github fail-level: error

Source