autonomic-bot
cf26ef863a
Anonymous GitHub API is 60 req/hr — a full weekly sweep across ~20 recipes exhausts it and the scan then reports sources as failed (visible, but degraded coverage). A token lifts it to 5000/hr. _github_token(): GITHUB_TOKEN env wins, else GITHUB_TOKEN_FILE (default /srv/cc-ci/.github-token, 0600, gitignored). Reading PUBLIC advisories needs NO scopes — a classic PAT with nothing ticked, or fine-grained limited to 'Public repositories: read'. The tool only ever GETs advisories; do not grant write scopes. A missing token is not an error: the scan runs anonymously and surfaces failures. Also gitignores .github-token and .hcloud-token.
35 lines
777 B
Plaintext
35 lines
777 B
Plaintext
# Secrets — NEVER commit
|
|
.testenv
|
|
*.tfstate
|
|
*.tfstate.*
|
|
*.key
|
|
*.pem
|
|
|
|
# Loop runtime / working clones (created at launch by launch.sh)
|
|
/cc-ci/
|
|
/cc-ci-adv/
|
|
/.cc-ci-watch/
|
|
/.cc-ci-logs/
|
|
|
|
# More secrets / local state — NEVER commit
|
|
/.sops/ # master recovery age key
|
|
/cc-ci-secrets/ # separate sops-secrets repo, cloned in
|
|
/.claude/* # local claude session/project state (history, cache, locks)
|
|
!/.claude/skills/ # ...but DO track shareable skills (e.g. ci-test-review)
|
|
*.tmp.* # editor temp files
|
|
.sops/
|
|
*age*.txt
|
|
*.age
|
|
master-age.txt
|
|
|
|
# Runtime completion markers
|
|
/cc-ci-plan/phase6-phase7.done
|
|
|
|
# Python bytecode cache
|
|
__pycache__/
|
|
*.pyc
|
|
|
|
# Local API tokens — never committed (advisory-scan / hetzner recovery)
|
|
.github-token
|
|
.hcloud-token
|