fix: add org baseline secret patterns to .gitignore

[don-petry]

Summary

• Copies the petry-projects org baseline secrets .gitignore as required by standards/push-protection.md
• Adds the three failing patterns called out in the compliance audit: .env, *.pem, *.key — plus the full org baseline (dotenv family, cloud credentials, SSH/TLS keys, Terraform, Kubernetes secrets, package registry dotfiles, etc.)
• Preserves the existing repo-specific .claude/scheduled_tasks.lock entry, which was merged into section 13 of the org baseline block

Changes

• .gitignore: replaced minimal 6-line file with full org baseline (~390 lines), keeping .claude/scheduled_tasks.lock

Closes #71

Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 41 minutes and 22 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a43b3f2c-e6eb-4973-a272-732862cc9466

📥 Commits

Reviewing files that changed from the base of the PR and between 8380f2f and 96e82bc.

📒 Files selected for processing (9)

• .github/workflows/claude.yml
• .github/workflows/pr-review.yml
• .gitignore
• prompts/cascade-action.md
• scripts/dev-lead-fix-ci.sh
• scripts/engine.sh
• scripts/list-prs.sh
• scripts/pr_review_health.sh
• scripts/review-one-pr.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-71-20260508-1426

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review: the change is a verbatim copy of the org baseline /.gitignore from petry-projects/.github, with the existing .claude/scheduled_tasks.lock line preserved inside section 13 (agent / local worktrees). No logic, no code — only glob patterns. CI (CodeQL) is running but should be unaffected by a .gitignore change. No CODEOWNERS file at the repo root; @don-petry please review and merge when ready.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 3176f6df2dbb3085f8cf87b79d132755ed266905
Review mode: triage-approved (single reviewer)

Summary

Confirmation review of a triage-cleared, low-risk change. The PR replaces the minimal 6-line .gitignore with the petry-projects org baseline (~390 lines of secret-only glob patterns), preserving the existing .claude/scheduled_tasks.lock entry inside section 13. No code, no logic, no workflows — only ignore patterns. This is a defensive change: it strengthens the first layer of push-protection by blocking commits of .env, *.pem, *.key, cloud-credential dotfiles, kubeconfigs, Terraform state, SOPS/age keys, DB dumps, package-registry credential dotfiles, IDE credential caches, and modern LLM/AI tooling auth files.

Linked issue analysis

Closes #71 — Compliance: gitignore_secrets_block (severity warning). The audit specifically called out missing .env, *.pem, *.key patterns and pointed at the org baseline at petry-projects/.github:/.gitignore. The diff matches that baseline and includes all three required patterns (sections 1 and 4). Issue is substantively addressed.

Findings

• No blockers. The change is a verbatim copy of the documented org baseline (per standards/push-protection.md#required-gitignore-entries) with the repo-specific .claude/scheduled_tasks.lock line retained.
• Negation ordering looks correct. !-rules immediately follow the broad pattern they carve out of (e.g. !.env.example after .env.*, !*.pub / !*.crt after the key-material block, !*.tfvars.example after *.tfvars). This matches the header comment's stated convention.
• False-positive surface is acknowledged. Sections 4 and 8 explicitly call out high-FP patterns (*.pem, *.key, .npmrc, gradle.properties) and document the per-repo !-by-file override pattern. Reasonable guidance for downstream repos.
• No code/secret-handling logic introduced. A .gitignore cannot run; risk is bounded to which files git tracks. Nothing in the diff stops git from tracking files that are already tracked, so the change has no effect on existing committed files (only on future git adds).

CI status

All required checks are green on 3176f6df:

• CodeQL — Analyze (actions): SUCCESS
• CodeQL: SUCCESS
• CodeRabbit: SUCCESS
• SonarQube Cloud: Quality Gate passed (0 new issues, 0 security hotspots)

Merge state is BLOCKED only because REVIEW_REQUIRED — this approval should unblock it.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Superseded by automated re-review at 9b631d2bed8cceb681df4fe625d66b895f2404b6 — click to expand prior review.

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

Superseded by automated re-review at 6fbcbb4.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing in favour of PR #304, which cherry-picks only the .gitignore expansion. The workflow/script changes in this PR were fully superseded by dev-lead refactoring merged over the past 20+ commits on main — rebasing the full branch would produce conflicts across 5 files without adding any net value.