[don-petry]

Summary

Addresses the security_and_analysis_unavailable compliance finding (issue #70) by bringing this repository into compliance with standards/push-protection.md.

Changes

.gitignore — adds the required baseline secret-protection patterns per standards/push-protection.md#required-gitignore-entries:

• .env
• *.pem
• *.key

API settings applied (outside this PR, via gh api PATCH):

• dependabot_security_updates: enabled (was disabled)

Remaining gap: security_and_analysis_unavailable

The root cause of this specific finding is that the compliance audit's ORG_SCORECARD_TOKEN lacks admin scope on .github-private. GitHub only returns the security_and_analysis field for admin-scoped tokens, so the audit always sees {} and reports unavailable.

To resolve this permanently, the owner of ORG_SCORECARD_TOKEN needs to be granted admin collaborator access to this repo, or the token needs to be replaced with one that has org-admin scope.

The settings secret_scanning_ai_detection and secret_scanning_non_provider_patterns did not respond to API PATCH — these may require org-level enablement in Settings → Code security first.

Closes #70

Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 30 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1db9ac64-5567-4461-b15f-a994941a70e0

📥 Commits

Reviewing files that changed from the base of the PR and between d3db52c and cd8274c.

📒 Files selected for processing (1)

• .gitignore

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-70-20260508-1425

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: bae94008261653c8ae53b6c6144d8231627fd051
Review mode: triage-approved (single reviewer)

Summary

A minimal, purely-additive change to .gitignore that appends the three baseline secret-protection patterns (.env, *.pem, *.key) required by standards/push-protection.md, with a clear header comment. Nothing else is changed; no code, workflows, or configuration are affected.

Linked issue analysis

Closes #70 (security_and_analysis_unavailable). The PR partially remediates that finding by satisfying the required-gitignore-entries portion of the push-protection standard and by enabling dependabot_security_updates via API (out-of-band). The PR body candidly documents that the residual security_and_analysis_unavailable signal is caused by ORG_SCORECARD_TOKEN lacking admin scope on this repo — a token/permissions issue not fixable in-tree — and provides clear next steps for whoever owns that token. That's an appropriate scope boundary for this PR.

Findings

• Diff content: Only .gitignore is touched (+5/-0). The added patterns match the standard exactly and are conventional, well-known patterns. No risk of unintentionally ignoring tracked files in this repo.
• Security: Additive ignore patterns can only reduce the chance of accidentally committed secrets; they cannot introduce vulnerabilities.
• CI / quality gates: CodeQL ✓, CodeRabbit ✓, SonarQube Cloud quality gate passed (0 new issues, 0 security hotspots). mergeStateStatus: BLOCKED reflects REVIEW_REQUIRED only.
• Open review threads: None. Copilot reported it couldn't review the file (gitignore patterns aren't reviewable code); CodeRabbit hit a rate limit on an earlier commit but its final status check passed on the head SHA.
• Noise: The PR has accumulated many Merge branch 'main' commits while waiting for review — not a blocker, but a squash-merge would keep history tidy.

CI status

All required checks green on bae9400:

• CodeQL — Analyze (actions): SUCCESS
• CodeQL: SUCCESS
• CodeRabbit: SUCCESS
• SonarQube Cloud quality gate: PASSED

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud