Christopher Fahlin
2f5587aaec
GitHub Actions workflow: mix precommit gate against a postgres:17 service container on PRs and pushes; on pushes to main, build the release image, gate on a Trivy HIGH/CRITICAL scan, emit an SBOM, push to Harbor, and sign the pushed tags with Cosign. - Image: harbor.icecoldchris.dev/bulwark/bulwark (tags: sha-<sha>, latest) - Commit the Cosign public key (cosign.pub) for verification; gitignore the private key (cosign.key / *.key)
65 lines
776 B
Plaintext
65 lines
776 B
Plaintext
# Mix build artifacts
|
|
/_build/
|
|
/deps/
|
|
/.fetch
|
|
*.ez
|
|
bulwark-*.tar
|
|
|
|
# Test / docs
|
|
/cover/
|
|
/doc/
|
|
/tmp/
|
|
|
|
# Erlang/OTP
|
|
erl_crash.dump
|
|
*.beam
|
|
|
|
# Assets build output
|
|
/priv/static/assets/
|
|
/priv/static/cache_manifest.json
|
|
|
|
# Node (asset pipeline)
|
|
/assets/node_modules/
|
|
npm-debug.log
|
|
|
|
# Database (legacy SQLite files + safety net)
|
|
*.db
|
|
*.db-*
|
|
|
|
# Uploaded artifacts
|
|
/priv/uploads/
|
|
|
|
# Environment / secrets
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
!.env.local.example
|
|
|
|
# Cosign signing key (private). The .pub is safe to commit (used to verify).
|
|
cosign.key
|
|
*.key
|
|
|
|
# Editor / IDE
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Dialyzer
|
|
/priv/plts/
|
|
|
|
# Releases
|
|
/_rel/
|
|
|
|
# Claude Code
|
|
.claude/
|
|
|
|
# Local deploy notes (regenerate in the infra repo session)
|
|
DEPLOYMENT.md
|
|
|
|
# CodeGraph index
|
|
.codegraph/
|