[IAmJSD]

Root cause

Five documented Make targets write files at the repo root, and .gitignore covered none of them. After a build, coverage run or scan, git add -A would pick them up. The worst case is the multi-MB linux/arm64 bootstrap Lambda binary. coverage.out was already covered by *.out, and bin/cudly-server by /bin/.

File	Written by
bootstrap	make build-lambda
coverage.html	make test-coverage
trivy-report.json	make security-scan-docker
tfsec-report.json	make security-scan-terraform
complexity-report.txt	make complexity-report

Fix

• .gitignore: one root-anchored pattern per file (/bootstrap, /coverage.html, /trivy-report.json, /tfsec-report.json, /complexity-report.txt). The issue also lists gosec-report.json, but since ci(gosec): run one rule set from a shared script in the hook, Makefile and CI #1145 make security-scan-go runs scripts/run-gosec.sh, which writes no root file, so it is left out. The issue suggests a *-report.json glob, but I used exact anchored names instead. Unanchored, the glob would also ignore any nested *-report.json fixture someone adds later, and the probe below shows it doing so.
• scripts/test-gitignore-make-artifacts.sh (new): checks each file in both directions with git check-ignore -v --no-index.
  • The root file is ignored, and the matching rule comes from .gitignore itself, so a developer's global excludes file or .git/info/exclude can't make it pass locally.
  • some/nested/dir/<name> is not ignored by .gitignore, so the patterns stay anchored.
  • Each name still appears in the Makefile on a line other than an rm line, so if a target is renamed or stops writing the file the test fails instead of guarding a file that is no longer produced. (make clean still lists gosec-report.json, which is why rm lines are skipped.)
• .github/workflows/ci.yml: new shell-only job gitignore-make-artifacts runs the script, and it is added to ci-success needs. It follows the same structure as the other self-test jobs: pinned checkout SHA, persist-credentials: false, contents: read.

Closes #279

Verification

All evidence comes from local runs against the real .gitignore: first on macOS, then re-run on Linux on the tree merged with origin/main (6124b1a3). I did not run the heavy Make targets (build, coverage, scanners) to produce the files; I used empty touch stand-ins with the same paths.

Fail before (the test script run against .gitignore without this PR's rules, on the merged tree):

$ bash scripts/test-gitignore-make-artifacts.sh
FAIL: root bootstrap (make build-lambda) is not ignored by .gitignore
FAIL: root coverage.html (make test-coverage) is not ignored by .gitignore
FAIL: root trivy-report.json (make security-scan-docker) is not ignored by .gitignore
FAIL: root tfsec-report.json (make security-scan-terraform) is not ignored by .gitignore
FAIL: root complexity-report.txt (make complexity-report) is not ignored by .gitignore
Results: 10 passed, 5 failed        (exit 1)

Pass after:

$ bash scripts/test-gitignore-make-artifacts.sh
PASS: root bootstrap is ignored by .gitignore:90:/bootstrap
...
Results: 15 passed, 0 failed        (exit 0, also from a different cwd)

Stand-in files present: after touch bootstrap coverage.html trivy-report.json tfsec-report.json complexity-report.txt at the root, git status --porcelain showed only this PR's own edits, and git status --porcelain --ignored listed all five as !!. I deleted the stand-ins afterwards.

No tracked file becomes ignored: git ls-files -ci --exclude-standard gives the same output before and after the change (diff identical, 13 entries). Those 13 are all pre-existing; see Out of scope. No tracked file anywhere in the tree has any of the five names (git ls-files | grep).

Mutation probes (each applied to .gitignore, then reverted):

Mutation	Result
/bootstrap changed to unanchored bootstrap	FAIL: nested bootstrap ignored
/trivy-report.json changed to the *-report.json glob	2 FAIL: nested trivy/tfsec reports ignored
/tfsec-report.json line deleted	FAIL: root tfsec-report.json not ignored
/bootstrap deleted, but present in a global core.excludesFile	FAIL: git ignores the file, but not through .gitignore
gosec-report.json row restored in the test (only make clean's rm line names it)	FAIL: Makefile no longer writes gosec-report.json
tfsec writer lines deleted from the Makefile (rm line kept)	FAIL: Makefile no longer writes tfsec-report.json

Other checks:

• shellcheck scripts/test-gitignore-make-artifacts.sh: clean
• actionlint .github/workflows/ci.yml: clean
• uvx zizmor==1.29.0 --offline --persona=pedantic --min-severity=medium .github/workflows/ci.yml: no findings (7 ignored, 1 suppressed; origin/main gives the same counts). Run before the main merge; not re-run since
• git diff --check: clean; files end with a newline
• git-secrets 1.3.0 (--register-aws in a fresh git init repo with an isolated HOME, scanning the three changed files with the repo's .gitallowed): clean; a planted fake secret key was caught as a positive control
• bash scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL on the merged tree
• No Go files changed, so go build/vet, golangci-lint, gocyclo and ./internal/mocks don't apply

Out of scope (noted, not changed)

• make clean removes the other four files but not complexity-report.txt, and it still removes gosec-report.json, which no target writes since ci(gosec): run one rule set from a shared script in the hook, Makefile and CI #1145. Both are one-line Makefile changes; I left them out to keep this PR to the ignore rules.
• git ls-files -ci --exclude-standard already lists 13 tracked files ignored by older patterns. These are the unanchored cleanup-lambda and clear-rate-limit patterns matching source directories, and .terraform.lock.hcl matching committed lock files. cloudformation/stacks/CUDly/template.yaml appears only on case-insensitive checkouts such as macOS, where it matches cudly. Tracked files stay tracked, but new files under those paths would be silently ignored. This PR leaves that set unchanged.

Labels

Could a maintainer please mirror the issue's triage labels onto this PR: impact/internal, type/chore, triaged, priority/p3, severity/low, urgency/eventually, effort/xs.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Merged origin/main to resolve conflicts in .github/workflows/ci.yml. There were no review findings on the previous head 09743dd4 to address.

Conflict (dd6d5d22)

• .github/workflows/ci.yml: main's fix(ci): bound prod down migrations so a large steps cannot run down -all #1084 added the migration-down-gate job and its ci-success needs entry at the same spot as this PR's gitignore-make-artifacts. I kept both, main's job first. Against main, the file now differs only by this PR's job (ci.yml:1302-1320) and needs entry (ci.yml:1345).

Semantic follow-up from main (6124b1a3)

• Since ci(gosec): run one rule set from a shared script in the hook, Makefile and CI #1145, make security-scan-go just runs scripts/run-gosec.sh, which prints text findings or writes SARIF into a given directory. Nothing writes gosec-report.json at the root any more. I dropped /gosec-report.json from .gitignore (.gitignore:87-94) and its row from the test.
• After the merge, the test's "still in the Makefile" check passed for gosec-report.json only because make clean's rm -f line still lists it. That is the stale guard the check was meant to catch. It now skips rm lines (scripts/test-gitignore-make-artifacts.sh:18-23,65-66,72). The CI job comment and the PR body now list five files, not six.
• Not changed (out of scope): make clean still runs rm -f gosec-report.json, which is harmless but stale.

Head: 6124b1a34d61157aa1a6328a2dbd025879592c79 (now MERGEABLE, still a draft)

Verification on the merged tree (Linux)

• bash scripts/test-gitignore-make-artifacts.sh: 15 passed, 0 failed (also run from /). With main's .gitignore: 10 passed, 5 failed.
• Mutation probes in a scratch worktree, each fails as intended:
  • gosec-report.json row restored: FAIL "Makefile no longer writes"; the old check gave PASS on the merged tree.
  • tfsec writer lines deleted: FAIL.
  • /trivy-report.json unanchored: FAIL.
  • /trivy-report.json changed to *-report.json: 2 FAIL.
  • /bootstrap deleted: FAIL.
• touch stand-ins: git status --porcelain is empty, and all five show as !! under --ignored.
• git ls-files -ci --exclude-standard is identical to origin/main (13 entries).
• shellcheck and actionlint are clean, and git diff --check is clean.
• scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL. I also ran git-secrets --register-aws in a fresh repo with an isolated HOME on the three changed files plus .gitallowed: clean, and a planted fake key was flagged.
• go build ./..., go vet ./... and go vet -tags integration ./... pass on the merged tree (sanity check only; this PR changes no Go, Terraform or frontend files).
• Not re-run: zizmor.