Don't allow .enroll.ini in CWD, rely on env var or XDG path

README.md

@@ -656,8 +656,8 @@ Enroll supports reading an ini-style file of all the arguments for each subcomma
 ### Location of the config file
 
 The path the config file can be specified with `-c` or `--config` on the command-line. Otherwise,
-Enroll will look for `./enroll.ini`, `./.enroll.ini` (in the current working directory),
-`~/.config/enroll/enroll.ini` (or `$XDG_CONFIG_HOME/enroll/enroll.ini`).
+Enroll will look for the `ENROLL_CONFIG` environment variable, `$XDG_CONFIG_HOME/enroll/enroll.ini`,
+or `~/.config/enroll/enroll.ini`.
 
 You may also pass `--no-config` if you deliberately want to ignore the config file even if it existed.
 

enroll/cli.py

@@ -39,8 +39,10 @@ def _discover_config_path(argv: list[str]) -> Optional[Path]:
       1) --no-config disables loading.
       2) --config PATH (or -c PATH)
       3) $ENROLL_CONFIG
-      4) ./enroll.ini, ./.enroll.ini
-      5) $XDG_CONFIG_HOME/enroll/enroll.ini (or ~/.config/enroll/enroll.ini)
+      4) $XDG_CONFIG_HOME/enroll/enroll.ini (or ~/.config/enroll/enroll.ini)
+
+    Current-directory config files are deliberately not auto-loaded; use
+    --config ./enroll.ini if that behaviour is desired.
 
     The config file is optional; if no file is found, returns None.
     """
@@ -66,12 +68,6 @@ def _discover_config_path(argv: list[str]) -> Optional[Path]:
     if envp:
         return Path(envp).expanduser()
 
-    cwd = Path.cwd()
-    for name in ("enroll.ini", ".enroll.ini"):
-        cp = cwd / name
-        if cp.exists() and cp.is_file():
-            return cp
-
     xdg = os.environ.get("XDG_CONFIG_HOME")
     if xdg:
         base = Path(xdg).expanduser()

tests/test_cli_config_and_sops.py

@@ -23,10 +23,10 @@ def test_discover_config_path_precedence(monkeypatch, tmp_path: Path):
     assert _discover_config_path(["harvest"]) == cfg
 
 
-def test_discover_config_path_finds_local_and_xdg(monkeypatch, tmp_path: Path):
+def test_discover_config_path_ignores_local_and_finds_xdg(monkeypatch, tmp_path: Path):
     from enroll.cli import _discover_config_path
 
-    # local file in cwd
+    # local files in cwd are deliberately ignored unless passed via --config
     cwd = tmp_path / "cwd"
     cwd.mkdir()
     local = cwd / "enroll.ini"
@@ -35,7 +35,8 @@ def test_discover_config_path_finds_local_and_xdg(monkeypatch, tmp_path: Path):
     monkeypatch.chdir(cwd)
     monkeypatch.delenv("ENROLL_CONFIG", raising=False)
     monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
-    assert _discover_config_path(["harvest"]) == local
+    assert _discover_config_path(["harvest"]) is None
+    assert _discover_config_path(["--config", str(local), "harvest"]) == local
 
     # xdg config fallback
     monkeypatch.chdir(tmp_path)