From 45f1ce680bb71491c1f2faed06916140a8a2f6e4 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Fri, 29 May 2026 15:11:09 -0400
Subject: [PATCH 1/2] Add repo hygiene: secret gitignore patterns + gitleaks
 pre-commit

- .gitignore: block *.pem, *.key, .env, .env.*, credentials.json, *.secret
  from ever being committed
- Add .pre-commit-config.yaml with the gitleaks hook (pinned v8.30.1) for
  secret scanning before commit
- Gitignore Brewfile.lock.json (records per-machine/arch bottle hashes; not
  portable, so not useful to track for reproducibility)
---
 .gitignore              | 1 -
 .pre-commit-config.yaml | 4 ++++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index eeb7bc6..bf7f550 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,6 @@ local
 gh/
 .claude
 .wrangler
-
 # Secrets and machine-local tool state
 *.pem
 *.key
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0f37bf7..eef9bf0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,5 +1,9 @@
+# Pre-commit hooks for this dotfiles repo.
+# Install once with: pre-commit install
+# Run against all files: pre-commit run --all-files
 repos:
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.1
     hooks:
+      # Scans staged changes for secrets before they can be committed.
       - id: gitleaks

From c3107138ba57edc23c43403c32ec6b85ded65a7b Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Mon, 6 Jul 2026 21:47:33 -0400
Subject: [PATCH 2/2] =?UTF-8?q?Ignore=20homebrew/=20=E2=80=94=20brew=20wri?=
 =?UTF-8?q?tes=20its=20tap=20trust=20store=20into=20XDG=5FCONFIG=5FHOME=20?=
 =?UTF-8?q?(this=20repo)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index bf7f550..11fa49e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,7 @@ gh/
 credentials.json
 *.secret
 Brewfile.lock.json
+
+# XDG_CONFIG_HOME points at this repo, so tools sometimes drop machine-local
+# state here. Homebrew writes its tap trust store (homebrew/trust.json).
 homebrew/