Remove .env from repo, harden secrets handling, update deps and Docker setup

[Copilot]

The repo had a committed .env, broken .gitignore (UTF-16 encoded), hardcoded credential values used as os.getenv() key names in storage.py, stale dependency pins, a docker-compose referencing a non-existent Dockerfile, and a bash-specific shell expansion incompatible with container sh.

Security

• Removed .env from git tracking (git rm --cached)
• Fixed backend/storage.py: credential values were literally used as env var names:

  # Before — exposes credential values in source
  access_key = os.getenv('068004E9D0BE3AECE1E7')
  secret_key = os.getenv('dMvlaq4pdisOwZqs37kKTldybXZGpQr15ky1x29V')
  
  # After
  access_key = os.getenv('FILEBASE_ACCESS_KEY')
  secret_key = os.getenv('FILEBASE_SECRET_KEY')

Environment / Config

• .gitignore: rewritten from broken UTF-16 to UTF-8; expanded with Python, venv, IDE, coverage, OS, and credential file patterns
• .env.example: new file covering all env vars across the codebase (APP_*, WEAVIATE_*, OPENAI_API_KEY, OPENROUTER_API_KEY, FILEBASE_*, STUDENT_API_KEY, SECRET_KEY, cache/rate-limit settings) with inline comments

Docker

• Dockerfile: added (was referenced by docker-compose.yml but missing); uses python:3.11-slim with system deps for audio/CV (ffmpeg, libsndfile1)
• docker-compose.yml:
  • Removed deprecated version: '3.8'
  • Fixed bash-specific ${RELOAD:+--reload} → POSIX sh if/then/else
  • Added env_file: .env and full environment block; bumped Weaviate image 1.19.0 → 1.24.0

Dependencies

• requirements.txt: bumped all packages to current supported versions; added missing boto3 (used by storage.py) and psutil (used by main.py)
• Notable bumps: fastapi 0.100→0.115, uvicorn 0.23→0.34, openai 1.0→1.68, langchain 0.1→0.3, torch 2.0→2.4, pydantic 2.0→2.10, pillow 10→11, pytest 7.4→8.3

README

• Added cp .env.example .env step in installation
• Added Docker Setup section
• Updated Configuration section to reflect actual env var names and reference .env.example

Original prompt

multi-Model-AI bug/security fixes

1. Remove .env file from repository and add .env to .gitignore
   • The committed .env exposes environment structure and risks accidental secrets leakage. Remove it from git and add to .gitignore.
2. Add and standardize .env.example
   • Create .env.example with all required keys, placeholder values and comments for setting up local dev (WEAVIATE_URL, OPENAI_API_KEY, etc).
   • Remove stray keys/values (e.g., 'Application settings' on line 2) from the actual .env if regenerating .env.example from it.
3. Update dependencies in requirements.txt for latest supported/secure versions, especially ai/ML packages and fastapi/uvicorn ecosystem.
4. Audit and update docker-compose.yml as needed:
   • Remove outdated/deprecated version: '3.8' unless required for compatibility.
   • Fix shell expansions: ${RELOAD:+--reload} is bash-style, but Docker uses sh (not always compatible). Prefer explicit boolean flags from env.
   • Create/add Dockerfile if referenced by docker-compose and not found in repo root.
5. README audit:
   • Add setup/usage/env instructions, clarifying example files and recommended environment setup.

This pull request was created from Copilot chat.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.