86bb9d6be0
Phase A of the quality-gate rollout — local + pre-push gates that stop
slop before it leaves the laptop. Preventative controls, per the
architect playbook.
- .husky/pre-commit — adds scripts/secret-scan.sh as the first check
before the existing Biome format/lint. Blocks the commit when a
likely secret is found in staged additions. Existing Biome behaviour
is preserved.
- .husky/pre-push (new) — runs `pnpm check` (lint + typecheck + test)
before the branch leaves the laptop. Mirrors the `check` job in
.github/workflows/ci.yml so PR-blocking issues surface locally first.
Bypassable for genuine emergencies with `git push --no-verify`.
- scripts/secret-scan.sh (new) — regex scan over staged additions for
the common accidents: AWS keys, Anthropic/OpenAI/GitHub/Slack/Google/
Stripe tokens, JWTs, PEM private key blocks, hardcoded password
literals. Validated against synthetic leaks of each type. No external
tool dependency — pure bash + grep, runs in <100ms typical.
- scripts/pr-evidence.sh (new) — drafts a PR_BODY.md from the diff vs
origin/main: file lists (added/modified/deleted), commit summaries,
and the QA checklist. Flags screenshots as REQUIRED when the diff
touches packages/web/src/{components,routes} or packages/desktop.
Wired as `pnpm pr:evidence` so it runs from anywhere in the
workspace.
- .gitignore — adds PR_BODY.md so drafts don't get committed by
accident.
Pre-commit stays fast (<2s typical). Heavy checks (typecheck, full
test run) live in pre-push.
47 lines
583 B
Plaintext
47 lines
583 B
Plaintext
# Logs
|
|
logs
|
|
*.log
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
pnpm-debug.log*
|
|
lerna-debug.log*
|
|
|
|
node_modules
|
|
dist
|
|
dist-ssr
|
|
*.local
|
|
|
|
# Editor directories and files
|
|
.vscode/*
|
|
!.vscode/extensions.json
|
|
!.vscode/settings.json
|
|
.idea
|
|
.DS_Store
|
|
*.suo
|
|
*.ntvs*
|
|
*.njsproj
|
|
*.sln
|
|
*.sw?
|
|
|
|
# fire-tools
|
|
.fire-tools-manifest.json
|
|
.fire-tools-delta.json
|
|
.fire-tools/
|
|
.pnpm-store/
|
|
.turbo/
|
|
|
|
# Playwright MCP
|
|
.playwright-mcp/
|
|
|
|
# TypeScript build info
|
|
*.tsbuildinfo
|
|
.tanstack/
|
|
|
|
# Tauri
|
|
packages/desktop/src-tauri/target/
|
|
packages/desktop/src-tauri/gen/
|
|
|
|
# Drafts from scripts/pr-evidence.sh
|
|
PR_BODY.md
|