5 Commits

Include renames

Author	SHA1	Message	Date
sneak	30d1e1758c	Ignore hardware-backed SSH key files in the canonical ignore files (closes #81) ... ssh-keygen names the private key file of a key backed by a hardware security key id_ecdsa_sk or id_ed25519_sk. Both canonical ignore files listed only the four plain key names, so these could be committed or copied into an image. Each file gets both names in its own pattern style, case-folded with character ranges; the .pub halves still match nothing and stay trackable. Model: opus-5-5	2026-10-04 06:50:49 +00:00
clawbot	7ea5cdcdcd	Cover more secret shapes in the canonical .gitignore (closes #38) ... The canonical .gitignore matched only .env, .env.*, *.pem and *.key, so prod.env, .envrc, *.p12 and *.pfx bundles, and the SSH private keys id_rsa, id_dsa, id_ecdsa and id_ed25519 could be committed. The secrets section now covers the same shapes as the canonical .dockerignore, written to gitignore's own rules: unanchored, no **/ prefix, character ranges for case. example.env and sample.env stay trackable through negations, and the comment tells a repository to add its own negation for any other committed template. Judgement call: the existing entries were rewritten with character ranges, which only widens them, and the bare .env line is dropped because *.env covers it. Model: opus-5-5	2026-10-03 17:39:40 +02:00
sneak	7b55c444ae	Keep in-repo agent scratch out of the build context and out of git (closes #27) ... The canonical .dockerignore and .gitignore both omitted the in-repo agent scratch directory, which holds one worktree per in-flight agent, so under `COPY . .` an entire extra checkout of the repo reached the image. The two entries are deliberately different shapes: anchored in .dockerignore, where the `**/` form would also delete a legitimately named nested directory, and unanchored in .gitignore, where a pattern already matches at every depth. Anchoring leaves a gap where agents run in subdirectories, stated in the vendored file itself. The second half is the consequence of excluding .git: `git describe` in a build stage yields an empty version without erroring, so the version is now computed on the host and passed in. Model: opus-5	2026-09-09 11:44:59 +00:00
sneak	06f279fa5b	Add security and git policies, make repo a model example ... - Never commit secrets; comprehensive .gitignore with fetch URL - Never force-push to main - go mod tidy before committing - make hooks target with Go repo detection - Add .editorconfig, .prettierrc, .prettierignore - Template files URL for new repo setup	2026-02-22 16:06:13 +01:00
sneak	efbac580f9	Add repo scaffolding to meet repository standards ... Add .gitignore, LICENSE (MIT), Makefile, Dockerfile, .dockerignore, and pin prettier via yarn lockfile for integrity-checked markdown formatting. Update REPO_POLICIES.md self-reference to point to this repo. Format markdown files with prettier.	2026-02-22 15:40:29 +01:00