security: harden CI Docker Compose credentials

Author: RinZ27

.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+# Cấu hình "Surgical Exclusion" - Chỉ quét đúng những gì mình thay đổi để tránh nhiễu từ repo gốc
+exclude: ^(?!bamboo/docker-compose\.yml|.pre-commit-config\.yaml)
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+      - id: check-merge-conflict
+      - id: mixed-line-ending
+        args: ['--fix=lf']
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.10
+    hooks:
+      - id: ruff
+      - id: ruff-format
+
+# Configuration pre-commit.ci
+ci:
+  autofix_prs: false
+  autoupdate_schedule: monthly

bamboo/docker-compose.yml

@@ -3,16 +3,16 @@ services:
   postgres:
     image: postgres:13.9-alpine
     environment:
-      - POSTGRES_PASSWORD=password
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-password}
     network_mode: "service:build_env"
   ftp:
     image: maven.earthdata.nasa.gov/cumuluss/vsftpd:3
     network_mode: "service:build_env"
     volumes:
       - ../packages/test-data:/srv:ro
     environment:
-      - FTP_USER=testuser
-      - FTP_PASSWORD=testpass
+      - FTP_USER=${FTP_USER:-testuser}
+      - FTP_PASSWORD=${FTP_PASSWORD:-testpass}
       - FTP_PASV_ADDRESS=127.0.0.1
   http:
     image: httpd:alpine