Story: ENFORCE — check_gitignore_baseline at error severity via the compliance engine #799

Activity

1. don-petry

   added

   enhancementFeature requestsFeature requests

   on Jul 19, 2026
2. don-petry commented on Jul 19, 2026

   

   don-petry

   on Jul 19, 2026

   ContributorAuthor

   More actions

   Part of Epic #801.
3. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Jul 19, 2026
4. don-petry commented on Jul 19, 2026

   

   don-petry

   on Jul 19, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #799 — Story: ENFORCE — check_gitignore_baseline at error severity via the compliance engine

   Scope

   Replace the weak 3-substring, warning-severity .gitignore check with a marker-block hash-drift check (pp_check_gitignore_baseline) that fires at error severity by comparing the repo's BEGIN … END petry-projects secrets baseline span against the org canonical block, leaving all L2 (below-END) entries free.

   Implementation Checklist

   • scripts/lib/push-protection.sh — add BEGIN/END marker constants, canonical-.gitignore path, pp_extract_baseline_block + pp_sha256 helpers, and pp_check_gitignore_baseline (findings: no .gitignore / baseline block missing / baseline block drifted; severity error; ref standards/gitignore-standard.md)
   • scripts/lib/push-protection.sh — retire PP_REQUIRED_GITIGNORE_PATTERNS + pp_check_gitignore_secrets_block; call the new check from pp_run_all_checks
   • scripts/compliance-remediate.sh — rename routing case gitignore_secrets_block → gitignore_baseline with baseline-copy guidance
   • standards/gitignore-standard.md + standards/push-protection.md — update enforced-by / compliance-check / severity-table references
   • .github/workflows/compliance-audit-tests.yml — trigger on scripts/lib/** and shellcheck the lib so the new check is gated

   Tests to Write

   • test/scripts/compliance-audit/gitignore-baseline.bats — four fixtures: compliant (pass), missing-block (error), drifted-block (error), block-present-with-L2-extensions (pass)
   • Update test/scripts/compliance-remediate/routing-messages.bats to the renamed gitignore_baseline check

   Test Command

   bats test/scripts/compliance-audit/ test/scripts/compliance-remediate/ plus bash .dev-lead/scripts/dev-lead-lint.sh
5. don-petry commented on Jul 19, 2026

   

   don-petry

   on Jul 19, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Implementation Complete

   Plan Execution

   • Added pp_check_gitignore_baseline (marker-block SHA-256 drift check, error severity) + pp_extract_baseline_block / pp_sha256 helpers in scripts/lib/push-protection.sh
   • Retired PP_REQUIRED_GITIGNORE_PATTERNS + pp_check_gitignore_secrets_block; wired the new check into pp_run_all_checks
   • Renamed remediation routing case → push-protection/gitignore_baseline with baseline-copy guidance
   • Updated standards/gitignore-standard.md (compliance-check section) + standards/push-protection.md (findings table: error)
   • Extended compliance-audit-tests.yml to trigger on scripts/lib/**
   • Added 4 fixtures (compliant / missing-block / drifted / block-with-L2) as bats tests; updated the remediate routing test

   Test Results

   1..8
   ok 1 compliant .gitignore (verbatim block) → no finding
   ok 2 verbatim block with extra trailing newlines still passes (trailing-newline tolerant)
   ok 3 no .gitignore at all → error finding
   ok 4 .gitignore without the marker block → error finding
   ok 5 block with an edited line inside the markers → drift error
   ok 6 block with an extra line injected inside the markers → drift error
   ok 7 verbatim block followed by L2 ecosystem/OS entries → no finding
   ok 8 L2 re-adding a broad pattern below END does not trip the check (only the block is inspected)
   
   # full suites tail:
   ok 165 copilot-instructions-missing-language-links routes to the content-agent path
   ok 166 applies PATCH to security_and_analysis for non_provider_patterns_enabled
   ok 167 applies PATCH to security_and_analysis for secret_scanning_non_provider_patterns (legacy alias)
   ok 168 dry-run does not call the GitHub API but records the planned change
   ok 169 failed PATCH is reported as a failure
   ok 170 non-remediated push-protection findings still hit the skip path
   

   Also green: bash .dev-lead/scripts/dev-lead-lint.sh and shellcheck --severity=warning on the lib, audit, and remediate scripts.

   Files Changed

   • scripts/lib/push-protection.sh: new baseline-block hash check at error severity; retired the weak 3-substring/warning path
   • scripts/compliance-remediate.sh: routing case renamed to gitignore_baseline
   • standards/gitignore-standard.md, standards/push-protection.md: docs + findings-table updates
   • .github/workflows/compliance-audit-tests.yml: trigger on scripts/lib/**
   • test/scripts/compliance-audit/gitignore-baseline.bats: new (8 tests over the 4 fixtures)
   • test/scripts/compliance-remediate/routing-messages.bats: updated for the renamed check

   Notes

   • Everything below the END marker is never inspected — verified by two L2-extension fixtures (including one that re-adds *.pem in L2). Trailing-newline tolerance verified. A missing/unreadable canonical .gitignore fails safe (fires a finding rather than silently passing every repo). The optional ci.yml PR-time assertion was left out as the issue marks it not-required — flag if wanted.
6. don-petry

   closed this as completedin #804on Jul 19, 2026
7. don-petry

   added a commit that references this issue on Jul 19, 2026

   feat: implement issue #799 — Story: ENFORCE — check_gitignore_baselin…

   ...

   ab49984