From 7ae334ff0e7288132a5928631753dd42eab4b43c Mon Sep 17 00:00:00 2001
From: Rafal Sikora <24563931+s1korrrr@users.noreply.github.com>
Date: Mon, 20 Jul 2026 23:52:02 +0200
Subject: [PATCH] chore: harden public repo ignore rules and release gates

Record enabled GitHub security settings and required checks, and expand
.gitignore so local assistant, credential, and build artifacts stay out
of the public tree.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .gitignore                               | 37 +++++++++++++++++++++++-
 docs/release/0.1.0/BLOCKERS.md           |  9 +++---
 docs/release/0.1.0/RELEASE_MANIFEST.json |  6 +++-
 docs/release/0.1.0/RELEASE_STATUS.md     |  4 +--
 4 files changed, 48 insertions(+), 8 deletions(-)

diff --git a/.gitignore b/.gitignore
index f94afd9..bb47b95 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,40 @@
+# SwiftPM / Xcode
 .build/
 .swiftpm/
-dist/
 DerivedData/
+*.xcuserstate
+xcuserdata/
+*.xcresult
+
+# Local packaging output
+dist/
+
+# Python / tooling caches (scripts and checkers)
+__pycache__/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage/
+htmlcov/
+
+# Local environment and credentials
+.env
+.env.*
+!.env.example
+*.pem
+*.p12
+*.mobileprovision
+*.cer
+*.certSigningRequest
+AuthKey_*.p8
+
+# Editor / OS / assistant local state
 .DS_Store
+.idea/
+.vscode/
+.cursor/
+.codex/
+.agents/
+*.swp
+*~
diff --git a/docs/release/0.1.0/BLOCKERS.md b/docs/release/0.1.0/BLOCKERS.md
index 8605167..f18a18d 100644
--- a/docs/release/0.1.0/BLOCKERS.md
+++ b/docs/release/0.1.0/BLOCKERS.md
@@ -6,10 +6,11 @@ The canonical public source is published through a fresh-history
 `rsitech-ai/devscope` snapshot. Legacy private objects, internal audits,
 monetization work, and author metadata are not transferred.
 
-1. **Repository protections — Repository owner.** Keep pull-request protection,
-   private vulnerability reporting, dependency alerts, and available security
-   features enabled. Add required hosted checks when Actions billing permits
-   reliable execution.
+1. **Repository protections — Maintained.** Public visibility, pull-request
+   protection, required `Secret Scan` and `Release Gates` checks, private
+   vulnerability reporting, secret scanning, push protection, and Dependabot
+   security updates are enabled on `rsitech-ai/devscope`. Re-verify after any
+   organization policy change.
 2. **Public archive — Release owner.** Inspect the exact public commit archive and
    record the tag, source commit, checksum, and all limitations in release
    metadata.
diff --git a/docs/release/0.1.0/RELEASE_MANIFEST.json b/docs/release/0.1.0/RELEASE_MANIFEST.json
index 8befddd..8979726 100644
--- a/docs/release/0.1.0/RELEASE_MANIFEST.json
+++ b/docs/release/0.1.0/RELEASE_MANIFEST.json
@@ -34,7 +34,11 @@
     "repositoryVisibilityChanged": true,
     "ownerSettingsVerified": true,
     "exactArchiveValidationPassed": true,
-    "hostedChecksStatus": "record-from-public-organization-pr"
+    "hostedChecksStatus": "required-secret-scan-and-release-gates-on-main",
+    "secretScanningEnabled": true,
+    "secretScanningPushProtectionEnabled": true,
+    "dependabotSecurityUpdatesEnabled": true,
+    "privateVulnerabilityReportingEnabled": true
   },
   "artifacts": [
     {
diff --git a/docs/release/0.1.0/RELEASE_STATUS.md b/docs/release/0.1.0/RELEASE_STATUS.md
index b110ee7..6bdeced 100644
--- a/docs/release/0.1.0/RELEASE_STATUS.md
+++ b/docs/release/0.1.0/RELEASE_STATUS.md
@@ -35,8 +35,8 @@ packaging passes, but the sandbox product is not feature-equivalent.
 | Community prerelease | READY (unnotarized) | Explicit acknowledgement, ad-hoc signature disclosure, embedded trust warning, clean universal zip, and published SHA-256 required |
 | Developer ID identity | PASS (installed) | `Developer ID Application: Rafal Sikora (2NY8A789TN)` is available with its private key |
 | Notarization | BLOCKED:EXTERNAL | No `devscope-notary` Keychain profile or equivalent App Store Connect credentials are configured |
-| Repository publication settings | OWNER ACTION | Verify public visibility, default-branch protection, private vulnerability reporting, and security settings after organization import |
-| Remote required checks | VERIFY ON PUBLIC PR | Record organization-run results; do not inherit the legacy personal repository's billing failure as code evidence |
+| Repository publication settings | PASS | Public `rsitech-ai/devscope`; branch protection with required PR, conversation resolution, and admin enforcement; private vulnerability reporting enabled; secret scanning, push protection, and Dependabot security updates enabled |
+| Remote required checks | PASS | `Secret Scan` and `Release Gates` are required status checks on `main`; organization PR and main-branch workflow runs recorded green |
 | Exact hardened-source archive | PASS (local) | The source tree passed readiness, 671 strict tests, warnings-as-errors release build, and exact-tree Gitleaks from a clean `git archive`; repeat from the exact public commit |
 
 ## Log boundary