name: staging-gateway-traefik
reference: refs/heads/main
working_dir: ./
compose_files:
  - base/traefik/docker-compose.yml
  - servers/staging/docker-compose.yaml
---
name: prod-gateway-traefik
reference: refs/heads/main
working_dir: ./
compose_files:
  - base/traefik/docker-compose.yml
  - servers/prod/docker-compose.yaml

for _, file := range c.ComposeFiles {
    cleaned := filepath.Clean(file)

    // Reject absolute paths (Unix + Windows)
    if filepath.IsAbs(cleaned) {
        return fmt.Errorf("%w: %s", ErrInvalidFilePath, file)
    }

    // Optionally reject paths that start with ".." (fast precheck)
    if cleaned == ".." || strings.HasPrefix(cleaned, ".."+string(os.PathSeparator)) {
        return fmt.Errorf("%w: %s", ErrInvalidFilePath, file)
    }

    // Resolve the path relative to working dir
    full := filepath.Join(workingDirOnDisk, cleaned)

    // Ensure full is still under workingDirOnDisk
    rel, err := filepath.Rel(workingDirOnDisk, full)
    if err != nil {
        return fmt.Errorf("%w: %s", ErrInvalidFilePath, file)
    }
    if rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
        return fmt.Errorf("%w: %s", ErrInvalidFilePath, file)
    }

    // (Optional but recommended) ensure the file exists and is a regular file
    st, err := os.Stat(full)
    if err != nil || !st.Mode().IsRegular() {
        return fmt.Errorf("%w: %s", ErrInvalidFilePath, file)
    }

    cleanComposeFiles = append(cleanComposeFiles, cleaned)
}

    // (Optional but recommended) ensure the file exists and is a regular file
    st, err := os.Stat(full)
    if err != nil || !st.Mode().IsRegular() {
        return fmt.Errorf("%w: %s", ErrInvalidFilePath, file)
    }