Extract Configuration Keys From Argparse and Env Bindings; Humans Own Units, Secrets, and Restarts

Description and use

The workflow extracts configuration keys from argparse, then requires human review to sign off on defaults, units, restarts, and secrets before publishing documentation.

Problem

Generated configuration pages often copy parser defaults without signed ownership for units, restarts, and secrets, leading to inaccurate or incomplete documentation.

Outcome

The workflow produces accurate, publication‑grade configuration documentation while keeping human‑owned claims explicit and verifiable.

Workflow

• 1. Run the extractor script on the target module to harvest flag names, env names, types, help strings, and default expressions as unevaluated strings.
• 2. Store the extracted data in a facts file (JSON/YAML).
• 3. Review the facts file and create a decision table next to it.
• 4. Draft documentation sections (grouping, headings, example YAML/dotenv) from the facts file using a docs editor.
• 5. For each claim that requires human ownership (default values, units, restart requirements, secret classification, deprecation), add a reviewer signature and evidence (release tag, runbook, threat note).
• 6. Reject any unsigned claim from the published reference.
• 7. Publish the finalized documentation once all required signatures are present.

Evidence

Generated configuration pages fail when they copy parser defaults without a signed owner for units, restarts, and secrets.

Source

The extractor only makes violations visible.

Source