← back to Kravet Sheet Sync 2026 04 20
security: strip hardcoded dw_admin secret -> env-first/passwordless. No rotation/deploy.
1d498b4bcf60d9dd342063166815e6167f621b7e · 2026-09-13 00:05:18 -0700 · Steve
Files touched
M attach_images.pyM audit_last_30.pyM build_dwkk_variant_map.pyM bulk_image_check.pyM bulk_push_v1.pyM delete_collision_pilots.pyM fix_audit_issues.pyM fix_pilot_variants.pyM kravet_finalize.pyM kravet_image_catalog.pyM load_catalog_to_pg.pyM price_update_pass.pyM test_push_2_items.pyM test_push_metafields_only.py
Diff
commit 1d498b4bcf60d9dd342063166815e6167f621b7e
Author: Steve <steve@designerwallcoverings.com>
Date: Sun Sep 13 00:05:18 2026 -0700
security: strip hardcoded dw_admin secret -> env-first/passwordless. No rotation/deploy.
---
attach_images.py | 2 +-
audit_last_30.py | 2 +-
build_dwkk_variant_map.py | 4 ++--
bulk_image_check.py | 6 +++---
bulk_push_v1.py | 4 ++--
delete_collision_pilots.py | 4 ++--
fix_audit_issues.py | 2 +-
fix_pilot_variants.py | 2 +-
kravet_finalize.py | 2 +-
kravet_image_catalog.py | 2 +-
load_catalog_to_pg.py | 4 ++--
price_update_pass.py | 4 ++--
test_push_2_items.py | 2 +-
test_push_metafields_only.py | 2 +-
14 files changed, 21 insertions(+), 21 deletions(-)
diff --git a/attach_images.py b/attach_images.py
index 4f894e5..ba02c83 100644
--- a/attach_images.py
+++ b/attach_images.py
@@ -19,7 +19,7 @@ TARGETS = [
def pg_rows(q):
r = subprocess.run(["ssh","root@45.61.58.125",
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -At -F "|" -c "{q}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -At -F "|" -c "{q}"'],
capture_output=True, text=True, check=True)
return [line.split("|") for line in r.stdout.strip().split("\n") if line]
diff --git a/audit_last_30.py b/audit_last_30.py
index bd57769..eec9907 100644
--- a/audit_last_30.py
+++ b/audit_last_30.py
@@ -25,7 +25,7 @@ NEW_ARRIVALS_GID='gid://shopify/Collection/167327760435'
def pg(sql):
r = subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
capture_output=True, text=True, check=True)
return [row for row in csv.reader(io.StringIO(r.stdout)) if row]
diff --git a/build_dwkk_variant_map.py b/build_dwkk_variant_map.py
index 3f2942c..bde9775 100644
--- a/build_dwkk_variant_map.py
+++ b/build_dwkk_variant_map.py
@@ -22,7 +22,7 @@ def gql(q, v=None):
def pg_exec(sql):
subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
capture_output=True, text=True, check=True)
@@ -100,5 +100,5 @@ with tempfile.NamedTemporaryFile("w", suffix=".csv", delete=False, newline="") a
r["price"] or "", r["cost"] or "", r["status"]])
tmp = tf.name
subprocess.run(["scp", tmp, "root@45.61.58.125:/tmp/dwkk_map.csv"], check=True)
-subprocess.run(SSH + ["""PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c \"\\copy kravet_dwkk_variant_map (dw_sku,product_gid,variant_gid,price,cost,status) FROM '/tmp/dwkk_map.csv' WITH (FORMAT csv)\""""], check=True)
+subprocess.run(SSH + ["""PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c \"\\copy kravet_dwkk_variant_map (dw_sku,product_gid,variant_gid,price,cost,status) FROM '/tmp/dwkk_map.csv' WITH (FORMAT csv)\""""], check=True)
print(f"wrote {len(seen)} rows to kravet_dwkk_variant_map")
diff --git a/bulk_image_check.py b/bulk_image_check.py
index 96f0039..3a3ebf0 100644
--- a/bulk_image_check.py
+++ b/bulk_image_check.py
@@ -19,14 +19,14 @@ UA = {"User-Agent": "Mozilla/5.0 (dw-sync bot)"}
def pg_cmd(sql: str) -> str:
r = subprocess.run(
- SSH + [f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -At -F "|" -c "{sql}"'],
+ SSH + [f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -At -F "|" -c "{sql}"'],
capture_output=True, text=True, check=True)
return r.stdout
def pg_exec(sql: str) -> None:
subprocess.run(
- SSH + [f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
+ SSH + [f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
capture_output=True, text=True, check=True)
@@ -115,7 +115,7 @@ pg_exec("""
""")
# Use a single session (temp table needs same session)
pg_exec("ALTER TABLE kravet_sheet_fields ADD COLUMN IF NOT EXISTS image_best_kind text")
-r = subprocess.run(SSH + ["""PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified <<'SQL'
+r = subprocess.run(SSH + ["""PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified <<'SQL'
CREATE TEMP TABLE _img_tmp (mfr_sku_norm text, hu text, lu text, status int, kind text);
\\copy _img_tmp FROM '/tmp/kravet_image_check.csv' WITH (FORMAT csv);
UPDATE kravet_sheet_fields s
diff --git a/bulk_push_v1.py b/bulk_push_v1.py
index 417811c..ff6963c 100644
--- a/bulk_push_v1.py
+++ b/bulk_push_v1.py
@@ -54,14 +54,14 @@ SMALL = {"a","an","the","and","or","but","of","in","on","at","for","to","with","
def pg(sql):
import csv, io
r = subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
capture_output=True, text=True, check=True)
return [row for row in csv.reader(io.StringIO(r.stdout)) if row]
def pg_exec(sql):
subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
capture_output=True, text=True, check=True)
diff --git a/delete_collision_pilots.py b/delete_collision_pilots.py
index 67341c7..2f04e12 100644
--- a/delete_collision_pilots.py
+++ b/delete_collision_pilots.py
@@ -43,11 +43,11 @@ for c in COLLISIONS:
# dw_sku_registry (my insert — may or may not have existed before, delete if mfr_sku is my new one)
]:
subprocess.run(["ssh","root@45.61.58.125",
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{q}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{q}"'],
capture_output=True, text=True, check=True)
# Registry: preserve if it existed before; only delete if created today
subprocess.run(["ssh","root@45.61.58.125",
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c '
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c '
f'"DELETE FROM dw_sku_registry WHERE dw_sku = \'{dwsku}\' AND created_at > NOW() - INTERVAL \'1 day\'"'],
capture_output=True, text=True, check=True)
diff --git a/fix_audit_issues.py b/fix_audit_issues.py
index f0618ee..c069b66 100644
--- a/fix_audit_issues.py
+++ b/fix_audit_issues.py
@@ -73,7 +73,7 @@ for item in IMAGE_FAILED:
continue
esc_sku = item["mfr"].replace("'", "''")
r = subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c '
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c '
f'"SELECT url FROM kravet_sku_images WHERE mfr_sku_raw = \'{esc_sku}\' ORDER BY kind, url LIMIT 3"'],
capture_output=True, text=True)
urls = [r[0] for r in csv.reader(io.StringIO(r.stdout)) if r]
diff --git a/fix_pilot_variants.py b/fix_pilot_variants.py
index 6b2d741..e8b7ff3 100644
--- a/fix_pilot_variants.py
+++ b/fix_pilot_variants.py
@@ -12,7 +12,7 @@ def gql(q,v=None):
def pg(q):
r=subprocess.run(["ssh","root@45.61.58.125",
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{q}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{q}"'],
capture_output=True,text=True,check=True)
return [row for row in csv.reader(io.StringIO(r.stdout)) if row]
diff --git a/kravet_finalize.py b/kravet_finalize.py
index e0da1cc..cd51ede 100644
--- a/kravet_finalize.py
+++ b/kravet_finalize.py
@@ -29,7 +29,7 @@ def pg(sql):
delimiter collisions with pipe-containing data (e.g. product titles)."""
import csv, io
r = subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
capture_output=True, text=True, check=True)
return [row for row in csv.reader(io.StringIO(r.stdout)) if row]
diff --git a/kravet_image_catalog.py b/kravet_image_catalog.py
index e62ce5f..c365b78 100644
--- a/kravet_image_catalog.py
+++ b/kravet_image_catalog.py
@@ -174,7 +174,7 @@ def process_sku(sku):
# ------------------------------------------------------------------
def pg_query(sql):
r = subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
capture_output=True, text=True, check=True)
import csv, io
return [row for row in csv.reader(io.StringIO(r.stdout)) if row]
diff --git a/load_catalog_to_pg.py b/load_catalog_to_pg.py
index 6bbf0f7..dc5d247 100644
--- a/load_catalog_to_pg.py
+++ b/load_catalog_to_pg.py
@@ -8,7 +8,7 @@ JSONL = "kravet_image_catalog.jsonl"
def pg_exec(sql):
subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
capture_output=True, text=True, check=True)
@@ -73,7 +73,7 @@ print(f"csv: {rows:,} rows ({skipped_dupes:,} in-file dupes)")
# Ship to Kamatera and COPY in
subprocess.run(["scp", tmp, "root@45.61.58.125:/tmp/kravet_images_load.csv"], check=True)
pg_exec("TRUNCATE kravet_sku_images")
-subprocess.run(SSH + ["""PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified <<'SQL'
+subprocess.run(SSH + ["""PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified <<'SQL'
\\copy kravet_sku_images (mfr_sku_norm, mfr_sku_raw, url, url_canonical, kind, source, product_url, product_name) FROM '/tmp/kravet_images_load.csv' WITH (FORMAT csv);
SELECT COUNT(*) AS rows, COUNT(DISTINCT mfr_sku_norm) AS skus FROM kravet_sku_images;
SELECT kind, COUNT(*) FROM kravet_sku_images GROUP BY kind ORDER BY COUNT(*) DESC;
diff --git a/price_update_pass.py b/price_update_pass.py
index 78c99ea..5a0faa2 100644
--- a/price_update_pass.py
+++ b/price_update_pass.py
@@ -34,14 +34,14 @@ _lock = threading.Lock()
def pg_rows(sql):
r = subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified --csv -t -c "{sql}"'],
capture_output=True, text=True, check=True)
return [row for row in csv.reader(io.StringIO(r.stdout)) if row]
def pg_exec(sql):
subprocess.run(SSH + [
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -c "{sql}"'],
capture_output=True, text=True, check=True)
diff --git a/test_push_2_items.py b/test_push_2_items.py
index c0664d5..4f8724f 100644
--- a/test_push_2_items.py
+++ b/test_push_2_items.py
@@ -53,7 +53,7 @@ def pg(query: str) -> list[list[str]]:
[
"ssh",
"root@45.61.58.125",
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified '
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified '
f'-At -F "|" -c "{query}"',
],
capture_output=True,
diff --git a/test_push_metafields_only.py b/test_push_metafields_only.py
index 03b59bd..5c4d4ef 100644
--- a/test_push_metafields_only.py
+++ b/test_push_metafields_only.py
@@ -27,7 +27,7 @@ def gql(query, variables=None):
def pg_rows(q):
r = subprocess.run(["ssh","root@45.61.58.125",
- f'PGPASSWORD=DW2024! psql -h 127.0.0.1 -U dw_admin -d dw_unified -At -F "|" -c "{q}"'],
+ f'PGPASSWORD=${process.env.PGPASSWORD||''} psql -h 127.0.0.1 -U dw_admin -d dw_unified -At -F "|" -c "{q}"'],
capture_output=True, text=True, check=True)
return [line.split("|") for line in r.stdout.strip().split("\n") if line]
← 52d817b auto-data-snapshot: 2026-08-30T23:23:51 (13 data files) — __
·
back to Kravet Sheet Sync 2026 04 20
·
fix: correct secret-strip's JS template-literal substitution 97b1991 →