Fetch the tags in the CI checkout (closes #208 )

The standard checkout action clones shallow and fetches no tags, so the version the build takes from `git describe --tags --always` would be a bare commit even on a tagged commit. The checkout step now sets `fetch-depth: 0`, as REPO_POLICIES.md asks of a repo that takes its version from the tags. Model: opus-5-5
Keep config.yml out of git and the Docker build context (closes #212 )
2026-10-04 23:59:32 +00:00 · 2026-10-05 01:58:32 +02:00 · 2026-10-05 01:24:41 +02:00
3 changed files with 18 additions and 0 deletions
@@ -66,3 +66,8 @@
 .gitignore
 /bin
 /data
+
+# Local config files, kept out of git because they can hold the signing key.
+**/[cC][oO][nN][fF][iI][gG].[yY][mM][lL]
+**/[cC][oO][nN][fF][iI][gG].[yY][aA][mM][lL]
+**/[cC][oO][nN][fF][iI][gG].[dD][eE][vV].[yY][mM][lL]
@@ -37,5 +37,6 @@ node_modules/
 *.sqlite3

 # Local dev configs
+config.yml
 config.yaml
 config.dev.yml
@@ -35,6 +35,18 @@ P2: security: per-IP rate limiting on the image routes
  in `.gitea/workflows/check.yml` sets `fetch-depth: 0`, as `REPO_POLICIES.md`
  asks of a repo that takes its version from the tags, so a CI build of a tagged
  commit stamps the tag from `git describe` instead of a bare commit.
+- 2026-10-04 `config.yml` stays out of git and the Docker build context (closes
+  #212): `.gitignore` now ignores `config.yml`, the config file Getting Started
+  creates with the signing key, and `.dockerignore` leaves it out in every
+  directory and in any letter case, as it already did `config.yaml` and
+  `config.dev.yml`.
+- 2026-10-04 local config files stay out of the Docker build context (closes
+  #211): `.dockerignore` now leaves out `config.yaml` and `config.dev.yml` in
+  every directory and in any letter case, the local config files `.gitignore`
+  keeps out of git because they can hold the signing key.
+  `configs/config.example.yml` is still sent. `config.yml`, which Getting
+  Started creates, is in neither file:
+  https://git.eeqj.de/sneak/pixa/issues/212.
 - 2026-10-04 `cmd/pixad/main.go` is one call into `internal/` (closes #206):
  what it did (the command line and its `--config` flag, setting
  `PIXA_CONFIG_PATH`, ignoring `SIGPIPE`, starting the fx app) is now `Run` in