tanshu
2aab1aec1e
gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.
21 lines
1.2 KiB
Markdown
21 lines
1.2 KiB
Markdown
# Agent notes
|
|
|
|
This repository holds one Ansible playbook per service. Read
|
|
[CODING_STANDARDS.md](CODING_STANDARDS.md) before adding or changing a playbook.
|
|
|
|
- Checks: run `./scripts/check.sh`. Add `--changed` while iterating to lint only
|
|
the YAML files that differ from HEAD. CI runs the full script.
|
|
- Review baseline: `origin/main`. The review diff is `git diff origin/main...HEAD`.
|
|
- Migration spec: [docs/podman-migration.md](docs/podman-migration.md). Section 8
|
|
lists the repo changes the migration expects.
|
|
- Issue tracker: [docs/agents/issue-tracker.md](docs/agents/issue-tracker.md).
|
|
- Scratch files: write them under `.scratch/`. It is git-ignored, and `/tmp` is
|
|
wiped between tool calls in this environment.
|
|
- Read-only `$HOME`: if `$HOME` is read-only, point `XDG_CACHE_HOME`,
|
|
`UV_CACHE_DIR`, `PIP_CACHE_DIR`, and `ANSIBLE_HOME` under `.scratch/`. The check
|
|
script already does this, and a vault password file has to live there too.
|
|
- Secrets: `vars/default.yml` holds deploy values, including passwords. gitleaks
|
|
runs before each commit and in CI. Known values are in
|
|
[.gitleaks-baseline.json](.gitleaks-baseline.json); rotate or vault a value
|
|
instead of adding a new entry.
|