phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI · 652bdbc364 - my-vault

phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

This commit is contained in:

windyboy

2026-09-26 11:31:48 +08:00

parent acca28b2dd

commit 652bdbc364

95 changed files with 91 additions and 8580 deletions

									
										.github/workflows/lint.yml
									
		+3
		
												View File
												
				@@ -23,6 +23,9 @@ jobs:

				        with:

				          node-version: '20'

				      - name: Vault Secret Scanner

				        run: node .scripts/verify-vault.mjs

				      - name: Install Dependencies

				        run: pnpm install