publish-gate: gitleaks + trufflehog (full history) + PII heuristics; CLEAN verdict gates any public flip, DIRTY = stays private. tuya-bridge: ghcr-credentials pull secret + image base -> ghcr; namespace added to the ghcr-credentials allowlist as a safety net (new ghcr packages default PRIVATE even from public repos — prune after visibility flip). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| .terraform.lock.hcl | ||
| main.tf | ||
| providers.tf | ||
| secrets | ||
| terragrunt.hcl | ||
| variables.tf | ||