From 980da6db003fae5ba9f63b916ad07393bef8cd5c Mon Sep 17 00:00:00 2001 From: Timothy Date: Thu, 30 Jul 2026 21:59:27 +0200 Subject: [PATCH] chore: ignore .codex/, and stop shipping a plaintext credential in docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit .codex/ is generated by `codex exec` as a machine-local mirror of the .claude hooks. It is deliberately NOT tracked even though .claude/ is (17 files): its config.toml embeds a plaintext Gitea credential and absolute /Users paths, so committing it would leak the credential and would not be portable anyway. Ignoring it also unblocks scripts/refresh-shared-checkout.sh, which refuses on a dirty tree. Separately, docs/handoffs/rest-api.md carried the same credential inline; it now references $ETV_GITEA_BASICAUTH like every other doc. NOTE this does not purge git history — the literal appears in 12 earlier commits and is still recoverable there. Refs: #698 Co-Authored-By: Claude Opus 5 (1M context) --- .gitignore | 6 ++++++ docs/handoffs/rest-api.md | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9dd03dfa7..340257d60 100644 --- a/.gitignore +++ b/.gitignore @@ -80,3 +80,9 @@ web/playwright-report/ # Per-session worktree-ownership marker (H7, ersatztv#303) — local, never committed .claude-worktree-owner + +# Codex CLI project scaffolding — a machine-local mirror of the .claude hooks, generated by +# `codex exec`. Deliberately NOT tracked even though `.claude/` is: its config.toml embeds a +# plaintext Gitea credential and absolute /Users paths, so it is neither portable nor safe to +# commit. See ersatztv#711 for the related merge-gate gap. +.codex/ diff --git a/docs/handoffs/rest-api.md b/docs/handoffs/rest-api.md index 700aa730b..45f4743e0 100644 --- a/docs/handoffs/rest-api.md +++ b/docs/handoffs/rest-api.md @@ -76,7 +76,7 @@ Only after Phase 1 sign-off. Per slice (start with #2a Channels): - **One branch = one PR.** PR runs `test` + `migrations` (both **required** to merge). Merge to `main` runs `test`+`migrations`+`build`+smoke/E2E. Verify green before closing each sub-issue. - Migrations only if the model changes — `scripts/add-migration.sh ` does **both** providers. - Adversarial self-review of the diff before closing (see memory: adversarial-self-review-at-milestones). Then Task Completion Protocol / `/done `. -- CI poll: `curl -u timothy:ded89Lm4 …/api/v1/repos/timothy/ersatztv/actions/tasks` (jobs by name), or the runs API. +- CI poll: `curl -u "$ETV_GITEA_BASICAUTH" …/api/v1/repos/timothy/ersatztv/actions/tasks` (jobs by name), or the runs API. ## Repo state at handoff - `main` is green; #1 closed (config/topology, not code — see `docs/m3u-xmltv.md`). #5 triaged as Jellyfin/infra (→ server-management). -- 2.47.3