[IAmJSD]

Root cause

Five documented Make targets write files at the repo root, and .gitignore covered none of them. After a build, coverage run or scan, git add -A would pick them up. The worst case is the multi-MB linux/arm64 bootstrap Lambda binary. coverage.out was already covered by *.out, and bin/cudly-server by /bin/.

File	Written by
bootstrap	make build-lambda
coverage.html	make test-coverage
trivy-report.json	make security-scan-docker
tfsec-report.json	make security-scan-terraform
complexity-report.txt	make complexity-report

Fix

• .gitignore: one root-anchored pattern per file (/bootstrap, /coverage.html, /trivy-report.json, /tfsec-report.json, /complexity-report.txt). The issue also lists gosec-report.json, but since ci(gosec): run one rule set from a shared script in the hook, Makefile and CI #1145 make security-scan-go runs scripts/run-gosec.sh, which writes no root file, so it is left out. The issue suggests a *-report.json glob, but I used exact anchored names instead. Unanchored, the glob would also ignore any nested *-report.json fixture someone adds later, and the probe below shows it doing so.
• scripts/test-gitignore-make-artifacts.sh (new): checks each file in both directions with git check-ignore -v --no-index.
  • The root file is ignored, and the matching rule comes from .gitignore itself, so a developer's global excludes file or .git/info/exclude can't make it pass locally.
  • some/nested/dir/<name> is not ignored by .gitignore, so the patterns stay anchored.
  • Each name still appears in the Makefile on a line other than an rm line, so if a target is renamed or stops writing the file the test fails instead of guarding a file that is no longer produced. (make clean still lists gosec-report.json, which is why rm lines are skipped.)
• .github/workflows/ci.yml: new shell-only job gitignore-make-artifacts runs the script, and it is added to ci-success needs. It follows the same structure as the other self-test jobs: pinned checkout SHA, persist-credentials: false, contents: read.

Closes #279

Verification

All evidence comes from local runs against the real .gitignore: first on macOS, then re-run on Linux on the tree merged with origin/main (6124b1a3). I did not run the heavy Make targets (build, coverage, scanners) to produce the files; I used empty touch stand-ins with the same paths.

Fail before (the test script run against .gitignore without this PR's rules, on the merged tree):

$ bash scripts/test-gitignore-make-artifacts.sh
FAIL: root bootstrap (make build-lambda) is not ignored by .gitignore
FAIL: root coverage.html (make test-coverage) is not ignored by .gitignore
FAIL: root trivy-report.json (make security-scan-docker) is not ignored by .gitignore
FAIL: root tfsec-report.json (make security-scan-terraform) is not ignored by .gitignore
FAIL: root complexity-report.txt (make complexity-report) is not ignored by .gitignore
Results: 10 passed, 5 failed        (exit 1)

Pass after:

$ bash scripts/test-gitignore-make-artifacts.sh
PASS: root bootstrap is ignored by .gitignore:90:/bootstrap
...
Results: 15 passed, 0 failed        (exit 0, also from a different cwd)

Stand-in files present: after touch bootstrap coverage.html trivy-report.json tfsec-report.json complexity-report.txt at the root, git status --porcelain showed only this PR's own edits, and git status --porcelain --ignored listed all five as !!. I deleted the stand-ins afterwards.

No tracked file becomes ignored: git ls-files -ci --exclude-standard gives the same output before and after the change (diff identical, 13 entries). Those 13 are all pre-existing; see Out of scope. No tracked file anywhere in the tree has any of the five names (git ls-files | grep).

Mutation probes (each applied to .gitignore, then reverted):

Mutation	Result
/bootstrap changed to unanchored bootstrap	FAIL: nested bootstrap ignored
/trivy-report.json changed to the *-report.json glob	2 FAIL: nested trivy/tfsec reports ignored
/tfsec-report.json line deleted	FAIL: root tfsec-report.json not ignored
/bootstrap deleted, but present in a global core.excludesFile	FAIL: git ignores the file, but not through .gitignore
gosec-report.json row restored in the test (only make clean's rm line names it)	FAIL: Makefile no longer writes gosec-report.json
tfsec writer lines deleted from the Makefile (rm line kept)	FAIL: Makefile no longer writes tfsec-report.json

Other checks:

• shellcheck scripts/test-gitignore-make-artifacts.sh: clean
• actionlint .github/workflows/ci.yml: clean
• uvx zizmor==1.29.0 --offline --persona=pedantic --min-severity=medium .github/workflows/ci.yml: no findings (7 ignored, 1 suppressed; origin/main gives the same counts). Run before the main merge; not re-run since
• git diff --check: clean; files end with a newline
• git-secrets 1.3.0 (--register-aws in a fresh git init repo with an isolated HOME, scanning the three changed files with the repo's .gitallowed): clean; a planted fake secret key was caught as a positive control
• bash scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL on the merged tree
• No Go files changed, so go build/vet, golangci-lint, gocyclo and ./internal/mocks don't apply

Out of scope (noted, not changed)

• make clean removes the other four files but not complexity-report.txt, and it still removes gosec-report.json, which no target writes since ci(gosec): run one rule set from a shared script in the hook, Makefile and CI #1145. Both are one-line Makefile changes; I left them out to keep this PR to the ignore rules.
• git ls-files -ci --exclude-standard already lists 13 tracked files ignored by older patterns. These are the unanchored cleanup-lambda and clear-rate-limit patterns matching source directories, and .terraform.lock.hcl matching committed lock files. cloudformation/stacks/CUDly/template.yaml appears only on case-insensitive checkouts such as macOS, where it matches cudly. Tracked files stay tracked, but new files under those paths would be silently ignored. This PR leaves that set unchanged.

Labels

Could a maintainer please mirror the issue's triage labels onto this PR: impact/internal, type/chore, triaged, priority/p3, severity/low, urgency/eventually, effort/xs.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Merged origin/main to resolve conflicts in .github/workflows/ci.yml. There were no review findings on the previous head 09743dd4 to address.

Conflict (dd6d5d22)

• .github/workflows/ci.yml: main's fix(ci): bound prod down migrations so a large steps cannot run down -all #1084 added the migration-down-gate job and its ci-success needs entry at the same spot as this PR's gitignore-make-artifacts. I kept both, main's job first. Against main, the file now differs only by this PR's job (ci.yml:1302-1320) and needs entry (ci.yml:1345).

Semantic follow-up from main (6124b1a3)

• Since ci(gosec): run one rule set from a shared script in the hook, Makefile and CI #1145, make security-scan-go just runs scripts/run-gosec.sh, which prints text findings or writes SARIF into a given directory. Nothing writes gosec-report.json at the root any more. I dropped /gosec-report.json from .gitignore (.gitignore:87-94) and its row from the test.
• After the merge, the test's "still in the Makefile" check passed for gosec-report.json only because make clean's rm -f line still lists it. That is the stale guard the check was meant to catch. It now skips rm lines (scripts/test-gitignore-make-artifacts.sh:18-23,65-66,72). The CI job comment and the PR body now list five files, not six.
• Not changed (out of scope): make clean still runs rm -f gosec-report.json, which is harmless but stale.

Head: 6124b1a34d61157aa1a6328a2dbd025879592c79 (now MERGEABLE, still a draft)

Verification on the merged tree (Linux)

• bash scripts/test-gitignore-make-artifacts.sh: 15 passed, 0 failed (also run from /). With main's .gitignore: 10 passed, 5 failed.
• Mutation probes in a scratch worktree, each fails as intended:
  • gosec-report.json row restored: FAIL "Makefile no longer writes"; the old check gave PASS on the merged tree.
  • tfsec writer lines deleted: FAIL.
  • /trivy-report.json unanchored: FAIL.
  • /trivy-report.json changed to *-report.json: 2 FAIL.
  • /bootstrap deleted: FAIL.
• touch stand-ins: git status --porcelain is empty, and all five show as !! under --ignored.
• git ls-files -ci --exclude-standard is identical to origin/main (13 entries).
• shellcheck and actionlint are clean, and git diff --check is clean.
• scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL. I also ran git-secrets --register-aws in a fresh repo with an isolated HOME on the three changed files plus .gitallowed: clean, and a planted fake key was flagged.
• go build ./..., go vet ./... and go vet -tags integration ./... pass on the merged tree (sanity check only; this PR changes no Go, Terraform or frontend files).
• Not re-run: zizmor.

[cristim]

Independent review 2 (claude-fleet, cold): APPROVE 6124b1a

What the +128 is: the title is only the last commit. Against main, the PR is the whole #279 fix (09743dd). It adds:

• a root-anchored .gitignore block (.gitignore:87-94) for /bootstrap, /coverage.html, /trivy-report.json, /tfsec-report.json and /complexity-report.txt;
• scripts/test-gitignore-make-artifacts.sh (98 lines);
• a gitignore-make-artifacts CI job, wired into ci-success needs.

The "drop gosec-report.json" commit (6124b1a) only removes a rule this branch added itself. Main never ignored /gosec-report.json.

Findings (none blocking):

• [non-blocking] PR title and squash message. The title describes only the last commit. A squash under it would hide that the PR adds 5 ignore rules, a test and a CI job, and that it closes HYG-06: .gitignore gaps for Makefile-produced root artifacts [platform part] #279. Use the 09743dd subject.
• [non-blocking] scripts/test-gitignore-make-artifacts.sh:66-71. The "Makefile still writes X" check is grep -F over every line that is not an rm line, so an echo line also satisfies it.
  • Probe P5 removed --out tfsec-report.json from Makefile:179. The test still passed, because the echo at Makefile:180 names the file.
  • This is the same kind of stale guard the last commit set out to catch, moved from rm lines to echo lines.
• [non-blocking, not a regression] An old gosec-report.json lying around is ignored on neither main nor head.
  • In a scratch repo it shows as ?? gosec-report.json, so git add -A would commit it.
  • make clean still removes it (Makefile:92, confirmed with make -n clean). That rm line is now the only cleanup path, so it should stay.
• [non-blocking, pre-existing, known-issues] scripts/security-scan.sh:14-15 writes security-reports/ in the current directory, and that directory is not ignored. It is outside HYG-06: .gitignore gaps for Makefile-produced root artifacts [platform part] #279, since no Make target calls the script.

"No Make target or script writes gosec-report.json" holds, including after #1145's rewrite. I ran git grep on head and origin/main across the Makefile, scripts/, .github/ and docs. The only hits are:

• the rm at Makefile:92;
• a comment at scripts/test-gitignore-make-artifacts.sh:22;
• a historical quote in docs/audits/codebase-audit-2026-09-02.md:8640.

The writers that remain produce other files:

• security-scan-go runs scripts/run-gosec.sh (Makefile:164-165), which prints text or writes DIR/gosec-<tag>.sarif. CI passes --sarif-dir "$RUNNER_TEMP" (ci.yml:843).
• scripts/security-scan.sh:43 writes security-reports/gosec-report.txt.

Mutation probes, in a scratch git init copy of the merged tree, each restored and confirmed identical with cmp:

• P1, /bootstrap deleted: FAILS.
• P2, coverage.html unanchored: the nested-path check FAILS.
• P3, the trivy rule moved to .git/info/exclude: FAILS, so the .gitignore:* source filter works.
• P4, the gosec row and rule re-added: the writer check FAILS, which proves the rm-line skip works.
• P5, the tfsec --out dropped: survives (the gap above).
• P6, -o bootstrap dropped from Makefile:58: FAILS.

Verified locally:

• git merge-tree --write-tree origin/main 6124b1a3: clean. In the merged ci.yml, both migration-down-gate and gitignore-make-artifacts are present as jobs and in the needs list.
• bash scripts/test-gitignore-make-artifacts.sh (in git init copies with core.excludesFile=/dev/null): 15 passed, 0 failed on head and on the merged tree.
• Fail-before: the head test on the base tree gives 5 FAIL lines and rc 1.
• actionlint .github/workflows/ci.yml and shellcheck on the script: clean.
• No Go, frontend or terraform changes.

Reviewed by an independent agent with no author context (second reviewer). Review only: nothing was pushed, and the GitHub review state is unchanged.

[cristim]

Independent review 2 (claude-fleet, cold), re-review: APPROVE c9eb4b3

This is a delta from my APPROVE at 6124b1a. The only new commit is a merge of origin/main (503eb2e):

• git log --first-parent 6124b1a34d61157aa1a6328a2dbd025879592c79..c9eb4b3b3906daad2c20260c526a8959688168d3 shows just that merge.
• git show --remerge-diff is empty, so the merge has no hand edits.
• The PR's own change is identical to the version I reviewed.
• git merge-tree --write-tree origin/main c9eb4b3b3906daad2c20260c526a8959688168d3 is clean.

Verified locally on a git archive export of c9eb4b3, with GOTOOLCHAIN=go1.26.10 and no cloud credentials, under the heavy lock:

• bash scripts/test-gitignore-make-artifacts.sh (in a git init copy): 15 passed, 0 failed.

My earlier findings and notes still apply unchanged.

Same reviewer as the earlier review, re-reviewing the new head. Review only: nothing was pushed, and the GitHub review state is unchanged.

[cristim]

VERDICT: REQUEST_CHANGES c9eb4b3

The content is correct; the blockers are a merge conflict with current main and one overstated guard.

Findings:

• blocking (merge state) .github/workflows/ci.yml:1709,1754 - main has moved past 503eb2e (fix(scripts): require GCP_PROJECT_ID and TF_BACKEND_GCP in gcp-import-dev-state.sh #1119 added the gcp-import-dev-state job and fix(ci): verify the rollback image in AWS_ACCOUNT_ID's registry #1112 added rollback-ecr-registry to ci-success needs), so the PR conflicts with origin/main 8f186a8 in three hunks, and GitHub reports CONFLICTING/DIRTY. The resolution is to keep both jobs and both needs entries. After merging main, git diff origin/main...<new head> should equal the current three-file diff.
• minor scripts/test-gitignore-make-artifacts.sh:65-72 - the "Makefile still writes " check matches any non-rm line, including the @echo "...: <name>" status lines. It therefore does not catch a renamed output for coverage.html, trivy-report.json, tfsec-report.json or complexity-report.txt. Probe: changing -o coverage.html to -o cov.html in Makefile:81 still gives 15 passed, because Makefile:82 echoes the name. The header comment (lines 18-23) and the PR body claim the opposite. Either narrow the match (for example, require -o, --out, --output or tee before the name) or reword the claim. Not a correctness risk for the ignore rules themselves.

Issue #279 check: the five root artifacts the Makefile writes today (bootstrap at Makefile:58, coverage.html at :81, complexity-report.txt at :152, trivy-report.json at :170, tfsec-report.json at :179) are now ignored by root-anchored rules. gosec-report.json is left out, which is justified: nothing in the tree writes it any more (run-gosec.sh writes SARIF only into --sarif-dir, and security-scan.sh writes into security-reports/). Only the stale make clean rm line and an audit doc name it. Using anchored names instead of the issue's *-report.json glob is a reasonable change from the issue's suggestion and is explained in the PR. coverage.out and bin/ were already covered.

Attacked:

• Ran the script on an export of c9eb4b3 (fresh git init, isolated HOME): 15 passed, 0 failed; also from another cwd. shellcheck: clean.
• Probe: /bootstrap changed to unanchored bootstrap -> FAIL (nested bootstrap ignored). Restored.
• Probe: deleted /tfsec-report.json -> FAIL (root not ignored). Restored.
• Probe: moved /coverage.html from .gitignore to .git/info/exclude -> FAIL (match must come from .gitignore). Restored.
• Probe: renamed the coverage.html output in the Makefile -> still passes (the minor finding above). Restored.
• Scanned the Makefile for other root writers (-o, --out, --output, tee, redirections, -coverprofile): none missed.
• ci-success uses an allowlist over toJSON(needs), so adding the job to needs is enough to gate on it. The new job pins actions/checkout by SHA with persist-credentials: false and contents: read, matching its sibling jobs.
• CI on c9eb4b3: 34 pass, 1 skipping (run against the older base).

[IAmJSD]

Reply to the REQUEST_CHANGES review on c9eb4b3, point by point:

• blocking (merge state), .github/workflows/ci.yml conflict with fix(scripts): require GCP_PROJECT_ID and TF_BACKEND_GCP in gcp-import-dev-state.sh #1119 / fix(ci): verify the rollback image in AWS_ACCOUNT_ID's registry #1112: fixed in 2296f11, which is a git merge origin/main. I resolved it the way you suggested and kept both jobs and both needs entries. Main's gcp-import-dev-state job and its tfstate-concurrency-group, rollback-ecr-registry and gcp-import-dev-state needs entries are unchanged. This PR's gitignore-make-artifacts job and needs entry come right after them. git diff origin/main...5b874c87 -- .github/workflows/ci.yml is the same 21-line addition as before. actionlint 1.7.12 on ci.yml exits 0, and PyYAML safe_load is ok.
• minor, scripts/test-gitignore-make-artifacts.sh:65-72 (any non-rm line counted, so the echo lines masked a renamed output): fixed in 5b874c8. The check now counts a name only when it follows -o, --out, --output, tee or a >/>> redirection, and ends at whitespace, ;, a quote or end of line. That makes the rm-line filter unnecessary, and the header comment now describes the narrower rule. Probes, each restored afterwards:
  • -o coverage.html to -o cov.html fails (14 passed, 1 failed). This was your probe.
  • tee complexity-report.txt to complexity.txt fails.
  • --out tfsec-report.json to tfsec.json fails.
  • --output trivy-report.json to trivy.json fails.
  • -o bootstrap to -o bootstrap2 fails.
  • On the unmodified Makefile: 15 passed, 0 failed, both from the repo root and from another cwd. shellcheck is clean.

The PR body's claim, that a renamed or dropped output fails the test, is now true as written.

Checks on 5b874c8: go build ./..., go vet ./..., go vet -tags integration ./..., and go vet -tags e2e in tests/e2e all pass. No Go package changed, so there was no lint, gocyclo or go test scope. The secrets scan prints "clean; planted key flagged", and scripts/test-git-secrets-allowlist.sh reports 183 PASS, 0 FAIL.

New head: 5b874c8

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 5b874c87393c636191fda72ea15ff6b9d5d31aa7

Blocking:

• none

Non-blocking:

• Issue HYG-06: .gitignore gaps for Makefile-produced root artifacts [platform part] #279's acceptance criteria list gosec-report.json; the PR leaves it out because make security-scan-go now goes through scripts/run-gosec.sh (SARIF under a sarif dir, no root JSON). I confirmed that in the Makefile and the script, so Closes #279 is fair. The leftover rm -f gosec-report.json in make clean and the missing complexity-report.txt in make clean are follow-ups, as the PR says.
• makefile_writes matches -o bootstrap anywhere in the Makefile, including inside a comment or under another target. That's fine for a guard test, but it doesn't prove that the named target writes the file.

Attacked:

• Fail-before: I put origin/main's .gitignore back in the scratch tree, and bash scripts/test-gitignore-make-artifacts.sh failed with 10 passed, 5 failed (exit 1), all five root artifacts not ignored. With the PR's .gitignore restored it gave 15 passed, 0 failed.
• git ls-files -ci --exclude-standard gives identical output before and after the change, so no tracked file becomes ignored. All five patterns are root-anchored.
• CI: the new job has contents: read, persist-credentials: false and the same pinned checkout SHA as the other 24 uses. It's added to ci-success needs, and that gate allowlists only success. YAML parses. shellcheck is clean. secrets-scan.sh printed "clean; planted key flagged". No Go changes, so there was no Go build or test to run.

Body-stale:

• "Each name still appears in the Makefile on a line other than an rm line": the script is now stricter. It only counts a name after -o/--out/--output/tee/a redirect, which also excludes the @echo status lines.
• "git ls-files -ci --exclude-standard ... 13 entries": on Linux against the current head it's 15 (the extra ones are cleanup-lambda/clear-rate-limit source files and .terraform.lock.hcl files). This PR still doesn't change the set.

_{Reviewer: rB25. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at 5b874c87393c636191fda72ea15ff6b9d5d31aa7 merged onto main (e3fce4a8), together with #1222, #1228 in that order (combined tree c70f8394, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 1 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 1 approving independent review(s) on 5b874c87, green CI, and the combined-tree verification above. Squash-merged at exactly 5b874c87393c636191fda72ea15ff6b9d5d31aa7.