tanshu
2aab1aec1e
gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.
1.2 KiB
1.2 KiB
Agent notes
This repository holds one Ansible playbook per service. Read CODING_STANDARDS.md before adding or changing a playbook.
- Checks: run
./scripts/check.sh. Add--changedwhile iterating to lint only the YAML files that differ from HEAD. CI runs the full script. - Review baseline:
origin/main. The review diff isgit diff origin/main...HEAD. - Migration spec: docs/podman-migration.md. Section 8 lists the repo changes the migration expects.
- Issue tracker: docs/agents/issue-tracker.md.
- Scratch files: write them under
.scratch/. It is git-ignored, and/tmpis wiped between tool calls in this environment. - Read-only
$HOME: if$HOMEis read-only, pointXDG_CACHE_HOME,UV_CACHE_DIR,PIP_CACHE_DIR, andANSIBLE_HOMEunder.scratch/. The check script already does this, and a vault password file has to live there too. - Secrets:
vars/default.ymlholds deploy values, including passwords. gitleaks runs before each commit and in CI. Known values are in .gitleaks-baseline.json; rotate or vault a value instead of adding a new entry.