Ignore hidden entries during secrets bootstrap

internal/engine/secrets.go

@@ -130,6 +130,7 @@ type stagedSecret struct {
 // LoadSecretsDir explicitly loads immediate regular files from directory into
 // previously unset process environment variables. Applications should call it
 // once during startup, before concurrent work; Load never calls it.
+// Dot-prefixed entries are ignored and omitted from the report.
 func LoadSecretsDir(directory string) (*SecretsReport, error) {
 	return loadSecretsDir(directory, secretsEnvironment{lookup: os.LookupEnv, set: os.Setenv}, secretsAccess{
 		openDirectory: os.Open,
@@ -168,13 +169,17 @@ func loadSecretsDir(directory string, environment secretsEnvironment, access sec
 	if closeErr != nil {
 		return report, secretsFailure(CodeSecretsRead, "secrets directory could not be closed: "+strconv.Quote(canonical))
 	}
+	entryLimitExceeded := len(entries) > secretsEntryLimit
+	entries = slices.DeleteFunc(entries, func(entry fs.DirEntry) bool {
+		return strings.HasPrefix(entry.Name(), ".")
+	})
 	slices.SortFunc(entries, func(left, right fs.DirEntry) int { return strings.Compare(left.Name(), right.Name()) })
 	report.entries = make([]SecretFileResult, len(entries))
 	for index, entry := range entries {
 		name := entry.Name()
 		report.entries[index] = SecretFileResult{Name: name, Path: filepath.Join(canonical, name), Status: SecretFileNotApplied}
 	}
-	if len(entries) > secretsEntryLimit {
+	if entryLimitExceeded {
 		return report, secretsFailure(CodeSecretsLimitExceeded, "secrets directory exceeds the 1024-entry limit: "+strconv.Quote(canonical))
 	}