Chris TonjesandClaude Opus 5.5
5f2d885fdc
Workflow moved to .gitea/workflows/ci.yml (Gitea is the CI host). Every gate now passes locally, step-for-step; green on main is pending an act_runner on gitea.doesworks.net (runs #1-#5 are queued "Waiting"). Gate fixes found by actually running them: - pip-audit: `--disable-pip` without `-r` was a usage error, so the old step could never pass. Now `pip-audit --strict .` audits the runtime dependency set from pyproject. - pip-audit then flagged ecdsa (PYSEC-2026-1325, no fix), a hard dep of python-jose. Swapped to PyJWT (HS256 only; 3-line change in auth/security.py). Flag to OWC. - PyJWT warned the test JWT secret was 11 bytes. JWT_SECRET now requires >= 32 bytes (RFC 7518 s3.2) at settings load; dev/compose/test defaults updated. Test-only value carries an inline gitleaks:allow. - bandit B101: assert in retention._count_past replaced with a raise. - gitleaks: gitleaks-action needs a GitHub token/license; replaced with the pinned 8.30.1 binary, sha256-verified, scanning full history. Added: - SBOM: CycloneDX 1.6 from a clean runtime-only venv (39 components), uploaded as a CI artifact. YPMS-POAM-042. - cyclonedx-bom in dev extras; CI outputs gitignored. 158 tests passing, 95.83% coverage; ruff, mypy, bandit, pip-audit, gitleaks clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
698 B
Plaintext
68 lines
698 B
Plaintext
# Python
|
|
__pycache__/
|
|
*.py[cod]
|
|
*.egg-info/
|
|
.venv/
|
|
venv/
|
|
.pytest_cache/
|
|
.mypy_cache/
|
|
.ruff_cache/
|
|
.pyre/
|
|
.pytype/
|
|
|
|
# Test / coverage
|
|
.coverage
|
|
.coverage.*
|
|
htmlcov/
|
|
coverage.xml
|
|
.tox/
|
|
|
|
# Build
|
|
dist/
|
|
build/
|
|
*.whl
|
|
|
|
# Environment / secrets
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Local DB
|
|
*.db
|
|
*.sqlite
|
|
*.sqlite3
|
|
pg_data/
|
|
|
|
# Docker
|
|
.docker/
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Editors / IDEs
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Node (if we end up with a client/ later)
|
|
node_modules/
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
.pnpm-debug.log*
|
|
|
|
# Logs
|
|
*.log
|
|
logs/
|
|
|
|
# Alembic scratch (real migrations are checked in under migrations/versions/)
|
|
alembic/
|
|
|
|
# CI outputs when run locally
|
|
sbom.cdx.json
|
|
gitleaks
|
|
gitleaks.tgz
|