feat: implement issue #797 — Story: STANDARDIZE — .gitignore secrets baseline → standalone standard + marker-wrapped block - #802
Conversation
…baseline → standalone standard + marker-wrapped block
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 53 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughChanges.gitignore baseline standardization
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #802 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a dedicated .gitignore standard (gitignore-standard.md) that codifies the two-layer model consisting of an org-managed secrets baseline (L1) and per-repository extensions (L2). It updates push-protection.md to reference this new standard and adds the corresponding managed-block markers to the root .gitignore. The review feedback suggests minor documentation improvements to accurately reflect that the L1 baseline covers standard agent worktrees and CI tool artifacts in addition to secrets.
There was a problem hiding this comment.
Pull request overview
Promotes the org-wide .gitignore secrets baseline into a standalone standard and makes the managed L1 block mechanically identifiable via canonical BEGIN/END markers, so compliance tooling and drift detection can reliably target the baseline.
Changes:
- Added a new
standards/gitignore-standard.mddefining the L1/L2 model, managed-block markers, and negation discipline. - Updated
standards/push-protection.mdto point “Required gitignore entries” at the new standard (removing duplicated rule text). - Wrapped the root
/.gitignoreL1 baseline with canonical BEGIN/END markers and added a short L2 guidance footer below the END marker.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
standards/push-protection.md |
Repoints the “Required gitignore entries” section to the new standalone .gitignore standard and links it under “Related Standards”. |
standards/gitignore-standard.md |
New standard document describing the baseline model, markers, negation rules, and compliance check. |
.gitignore |
Adds canonical BEGIN/END markers around the managed baseline and appends L2 guidance below the END marker. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@standards/push-protection.md`:
- Around line 319-322: Restore the “Required gitignore entries” heading above
the onboarding cross-reference so the existing `#required-gitignore-entries` link
remains valid, without duplicating the rules already defined in
gitignore-standard.md; alternatively, update that onboarding link to target
gitignore-standard.md directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: b7b42ced-7b84-4f6e-9a9a-2d1a29e54ec0
📒 Files selected for processing (3)
.gitignorestandards/gitignore-standard.mdstandards/push-protection.md
|
@coderabbitai resolve |
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
✅ Action performedComments resolved and changes approved. |
|
Dev-Lead — waiting on PR blockers (intent: fix-reviews)PR: #802 |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 75b8f7a1e73f890208d83e5c912781aa3221eed5
Review mode: triage-approved (single reviewer)
Summary
Promotes the org .gitignore secrets baseline into a standalone standard (standards/gitignore-standard.md), wraps the L1 block in /.gitignore with canonical BEGIN/END markers (comment-only lines — no ignore pattern changed), and repoints push-protection.md to the new standard. Confirms the triage low-risk assessment.
Linked issue analysis
Closes #797. All three deliverables are met: (1) gitignore-standard.md exists with the L1/L2 two-layer model and the negation-discipline rules preserved; (2) the L1 block in /.gitignore is wrapped in the BEGIN/END markers with byte-content otherwise unchanged (all added lines are comments); (3) push-protection.md § 'Required gitignore entries' now points to the new standard without duplicating rule text, and the heading (anchor target) is retained. Verified against the head repo that the documented enforcement chain is accurate: compliance-audit.sh sources scripts/lib/push-protection.sh and calls pp_check_gitignore_secrets_block via pp_run_all_checks, and the documented anchors (.env, *.pem, *.key) match the library. Note: the issue named the check 'check_gitignore_baseline', but the doc correctly references the real function name.
Findings
No blocking findings. All 4 review threads (gemini-code-assist ×2, copilot ×1, coderabbitai ×1) are resolved; CodeRabbit's earlier changes-requested review was superseded by its approval after the fix commit 75b8f7a. The 'secrets-only' wording flagged by reviewers was corrected to acknowledge agent/CI paths. The run_secret_scanning MCP tool was not available in this environment; the gitleaks CI secret scan passed. The .gitignore diff adds only comment lines, so no secrets-protection behavior changes.
CI status
All checks green: Lint, ShellCheck, CodeQL, SonarCloud, agent-shield, Agent Security Scan, Secret scan (gitleaks), npm audit all SUCCESS; ecosystem audits skipped (not applicable). Cancelled dev-lead dispatch/ci-relay entries are superseded runs — the final dev-lead dispatch succeeded and ci-relay was intentionally skipped via [skip ci-relay].
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Closes #797
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit
.gitignoremodel with managed baseline markers and repository-specific extension guidance..gitignorestandard.