Compliance: gitignore_baseline

[don-petry]

Compliance Finding

Category: push-protection
Severity: error
Check: gitignore_baseline

Detail

.gitignore secrets-baseline block has drifted from the org canonical block (hash mismatch) — re-copy it verbatim; never edit inside the markers

Standard Reference

standards/gitignore-standard.md#l1--secrets-baseline-org-managed-verbatim-required

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead Implementation Plan

Issue: #376 — Compliance: gitignore_baseline

Scope

Restore the .gitignore L1 secrets-baseline managed block to match the org canonical /.gitignore verbatim (resolve the SHA-256 hash-mismatch drift).

Root Cause

Diffing the repo's marker block (BEGIN … END, lines 1–398) against the canonical block in petry-projects/.github /.gitignore shows a single drifted line inside the markers:

• line 215: repo had *.sql.bak; canonical is *.bak

Implementation Checklist

• .gitignore — change line 215 *.sql.bak → *.bak to restore verbatim parity with the canonical block

Tests to Write

• Config-only, behavior-preserving change; no repo test framework covers .gitignore. Verification is done by reproducing the audit's own check locally (pp_extract_baseline_block + SHA-256 from scripts/lib/push-protection.sh) and confirming the repo block hash equals the canonical block hash.

Test Command

Reproduced audit check: extract L1 span (markers inclusive, \r stripped) and compare sha256sum of repo block vs. org canonical /.gitignore block.

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Identified the drift by diffing the repo's L1 marker block against the org canonical /.gitignore block
• Restored .gitignore line 215 *.sql.bak → *.bak (verbatim canonical value)
• Verified repo block SHA-256 now equals the canonical block hash
• Ran required repo lint (.dev-lead/scripts/dev-lead-lint.sh) — passed

Verification (reproduced the audit's own pp_check_gitignore_baseline logic)

canonical: 61b7fb3be5d9725b4eca3381fa0e910504bb98900a1b9552c5ec749bde4f70f1
repo now : 61b7fb3be5d9725b4eca3381fa0e910504bb98900a1b9552c5ec749bde4f70f1
PASS: block now matches canonical verbatim
=== full block diff (should be empty) ===
(no diff)

Required repo lint:

  [lint] shellcheck: no .sh files found — skipping
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

Files Changed

• .gitignore: single line inside the managed L1 block restored to canonical (*.sql.bak → *.bak); nothing below the END marker was touched.

Notes

• TDD Phase 2 skipped per the documented exception: this is a config-only, behavior-preserving change to bring the org-managed block into verbatim compliance; no repo test framework covers .gitignore. Verification instead reproduces the audit's extraction (\r-stripped, markers inclusive) and SHA-256 comparison from scripts/lib/push-protection.sh.
• No *.bak files are currently tracked, so broadening *.sql.bak → *.bak has no effect on existing tracked files.
• Edit was confined strictly inside the BEGIN…END markers, matching the canonical source of truth (petry-projects/.github /.gitignore).

[don-petry]

Weekly Compliance Audit (2026-07-31)

This finding is still open.

Detail: .gitignore secrets-baseline block has drifted from the org canonical block (hash mismatch) — re-copy it verbatim; never edit inside the markers

Standard: standards/gitignore-standard.md#l1--secrets-baseline-org-managed-verbatim-required