fix(publish): honor env_file required: false for missing files

[Ijtihed]

What I did

When env_file declares required false and the file is missing then docker compose publish now skips the file instead of failing. If the optional file exists it is still scanned for sensitive data and included as a layer which preserves existing behavior.

Two locations needed guards:

• processFile: where env files are hashed and added as OCI layers
• checkForSensitiveData: where env files are scanned for secrets

Non-ENOENT errors (permissions, etc.) still propagate regardless of the required flag.

Related issue

Fixes #13648

Supersedes #13650, #13651, #13652 with a diff implementing what the maintainers request in #13652 review

(unrelated photo of my fiance's cute cat :3)

[glours]

Thanks for picking this up and aligning with the #13652 review, the fix is in the right shape. Two small asks before merging:

1. Dead branch in processFile (publish.go:262-264): the if envFile.Required path is unreachable in production because the project loader already enforces required: at load time. Suggest dropping it (and its test) or commenting it as defensive only.
2. Path leak on optional missing (publish.go:265): when the file is absent we skip ReplaceEnvFile, so the published YAML keeps the local path instead of the <hash>.env placeholder. Since the hash is computed from the path string alone, we can still rewrite it — keeps the artifact filesystem-agnostic and consistent with the file-present case.

[glours]

Nit: this if envFile.Required branch is unreachable here, the project loader (called from runPublish without SkipResolveEnvironment) already rejects missing required env files via compose-go's loadEnvFile.
The test only reaches it by forcing SkipResolveEnvironment: true.
Could you either drop the branch (and Test_processFile_required_env_file_missing) or add a comment marking it as belt-and-suspenders?
The guard in checkForSensitiveData is fine, that one is reachable because loadUnresolvedFile does set SkipResolveEnvironment.

[Ijtihed]

Dropped them, thanks!

[glours]

Could you still call transform.ReplaceEnvFile with the hash in this skip branch? The hash is derived from envFile.Path only (not file contents), so it's deterministic whether the file exists or not.
Without the rewrite, the published YAML keeps the publisher's local (resolved-to-absolute) path instead of the opaque <hash>.env placeholder, small filesystem-layout leak, and inconsistent with the file-present case.

[Ijtihed]

Good catch and thanks! Done. path no longer leaks now :)

[glours]

LGTM, thanks for the contribution 🙏

[codecov]

Codecov Report

❌ Patch coverage is 63.63636% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/compose/publish.go	63.63%	2 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!