Add the lint configuration and the Makefile

ansible-lint at the production profile from the first commit, which is much cheaper than adopting it later. yamllint forbids implicit octal so a file mode cannot silently become an integer, and the Makefile is a thin wrapper so `make check` and CI run byte-identical commands. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-09-16 03:58:01 +02:00
parent ff0a518001
commit 9b9e39e67f
4 changed files with 103 additions and 0 deletions
@@ -0,0 +1,20 @@
+# gitleaks configuration. Run in CI by the lint workflow of whichever platform is
+# in use (.github/workflows/lint.yml, .gitea/workflows/lint.yml, or the lint job
+# in .gitlab-ci.yml) over the working tree *and* the history — a secret that was
+# committed and then deleted is still a leaked secret, and the only fix is
+# rotating it.
+title: "config repository secret scan"
+
+[extend]
+# Start from the upstream rule set rather than reinventing it.
+useDefault = true
+
+[allowlist]
+description = "Documentation and examples"
+paths = [
+  # Every value here is a placeholder or an empty assignment. The real thing
+  # lives in a .env on the host, which this repository never contains.
+  '''.*\.env\.example$''',
+  # Documentation quotes variable names and shows the shape of a key.
+  '''^docs/secrets\.md$''',
+]