5 Commits

Include renames

Author	SHA1	Message	Date
clawbot	567944f8d8	Ignore hardware-backed SSH key files in the canonical ignore files (closes #81) ... `ssh-keygen` names the private key of a key backed by a hardware security key `id_ecdsa_sk` or `id_ed25519_sk`. The canonical `.gitignore` and `.dockerignore` listed only `id_rsa`, `id_dsa`, `id_ecdsa` and `id_ed25519`, so a repository could commit these files or copy them into an image. Both names are added beside their plain counterparts in each file's own style: unanchored in `.gitignore`, `**/`-prefixed in `.dockerignore`, case-folded with character ranges in both. A pattern matches the whole file name, so the `.pub` halves stay trackable and still reach the build context. Model: opus-5-5	2026-10-04 09:14:52 +02:00
clawbot	7ea5cdcdcd	Cover more secret shapes in the canonical .gitignore (closes #38) ... The canonical .gitignore matched only .env, .env.*, *.pem and *.key, so prod.env, .envrc, *.p12 and *.pfx bundles, and the SSH private keys id_rsa, id_dsa, id_ecdsa and id_ed25519 could be committed. The secrets section now covers the same shapes as the canonical .dockerignore, written to gitignore's own rules: unanchored, no **/ prefix, character ranges for case. example.env and sample.env stay trackable through negations, and the comment tells a repository to add its own negation for any other committed template. Judgement call: the existing entries were rewritten with character ranges, which only widens them, and the bare .env line is dropped because *.env covers it. Model: opus-5-5	2026-10-03 17:39:40 +02:00
sneak	7b55c444ae	Keep in-repo agent scratch out of the build context and out of git (closes #27) ... The canonical .dockerignore and .gitignore both omitted the in-repo agent scratch directory, which holds one worktree per in-flight agent, so under `COPY . .` an entire extra checkout of the repo reached the image. The two entries are deliberately different shapes: anchored in .dockerignore, where the `**/` form would also delete a legitimately named nested directory, and unanchored in .gitignore, where a pattern already matches at every depth. Anchoring leaves a gap where agents run in subdirectories, stated in the vendored file itself. The second half is the consequence of excluding .git: `git describe` in a build stage yields an empty version without erroring, so the version is now computed on the host and passed in. Model: opus-5	2026-09-09 11:44:59 +00:00
sneak	06f279fa5b	Add security and git policies, make repo a model example ... - Never commit secrets; comprehensive .gitignore with fetch URL - Never force-push to main - go mod tidy before committing - make hooks target with Go repo detection - Add .editorconfig, .prettierrc, .prettierignore - Template files URL for new repo setup	2026-02-22 16:06:13 +01:00
sneak	efbac580f9	Add repo scaffolding to meet repository standards ... Add .gitignore, LICENSE (MIT), Makefile, Dockerfile, .dockerignore, and pin prettier via yarn lockfile for integrity-checked markdown formatting. Update REPO_POLICIES.md self-reference to point to this repo. Format markdown files with prettier.	2026-02-22 15:40:29 +01:00