.github/claude-security-paths header still reads "Format: GitHub Actions paths: patterns, one per line."
Since the caller repin to ci-workflows v0.10.2 (#1990), the reusable matches root-anchored gitignore patterns via git check-ignore and hard-errors on !, ?, or +. The file is clean today (verified: no such characters; all 26 patterns behave identically under the new anchoring), but the comment actively invites a future editor to add syntax that now fails the security lane closed.
Fix: rewrite the header to state gitignore semantics, root-anchoring, and the forbidden characters. Surfaced by the fresh-context merge verifier on #1990 (non-blocking, LOW).
.github/claude-security-pathsheader still reads "Format: GitHub Actionspaths:patterns, one per line."Since the caller repin to ci-workflows v0.10.2 (#1990), the reusable matches root-anchored gitignore patterns via
git check-ignoreand hard-errors on!,?, or+. The file is clean today (verified: no such characters; all 26 patterns behave identically under the new anchoring), but the comment actively invites a future editor to add syntax that now fails the security lane closed.Fix: rewrite the header to state gitignore semantics, root-anchoring, and the forbidden characters. Surfaced by the fresh-context merge verifier on #1990 (non-blocking, LOW).