chore: drop legacy secrets ignore#64
Conversation
|
No changeset is needed for this PR. The change only updates personal dotfiles guidance and the global gitignore source; it does not affect a versioned package artifact. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the documentation for safe agent actions in .claude/CLAUDE.md and removes .secrets from the .gitignore file. The review feedback suggests expanding the list of secret file examples in the documentation to include *.pem, *.key, and restoring ~/.secrets to provide more comprehensive security guardrails for the agent.
| - Only execute explicitly requested actions | ||
| - **Requires explicit instruction**: git operations (commits, pushes, branch changes), deploys | ||
| - **Safe without asking**: tests, linting, type checks, read-only git (`git diff`, `git status`, `git log`), reading files (except secret files, e.g., `~/.secrets`, `.env`), exploring codebase | ||
| - **Safe without asking**: tests, linting, type checks, read-only git (`git diff`, `git status`, `git log`), reading files (except secret files, e.g., `.env`, `.env.local`), exploring codebase |
There was a problem hiding this comment.
The list of secret file examples should be comprehensive to ensure the agent avoids all sensitive files. Since *.pem and *.key are also ignored in .gitignore, adding them here provides better security guardrails. Additionally, keeping ~/.secrets is advisable as this configuration is synced globally and the agent may encounter this legacy pattern in other contexts or the home directory.
| - **Safe without asking**: tests, linting, type checks, read-only git (`git diff`, `git status`, `git log`), reading files (except secret files, e.g., `.env`, `.env.local`), exploring codebase | |
| - **Safe without asking**: tests, linting, type checks, read-only git (`git diff`, `git status`, `git log`), reading files (except secret files, e.g., `.env`, `.env.local`, `*.pem`, `*.key`, `~/.secrets`), exploring codebase |
1 participant
Summary
.secretsentry from the global gitignore source.envand.env.localVerification
git diff --check -- .claude/CLAUDE.md .gitignore.secretsscan on changed files returned no matchesRisk
Low. This only updates dotfiles guidance and the global gitignore source. Existing local secret files should already be migrated away from
.secrets.