From e3b047fa61fe1ed4dcb33e365a28d31b76964efd Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Wed, 26 Aug 2026 11:33:02 +0200 Subject: [PATCH] chore: gitignore the GitHub App private key temp file app-pk.tmp holds the GitHub App private key, pasted out of the App settings page during the Flux source cutover. It sat untracked and unignored in the repository root, one `git add .` away from being committed. The credentials block above it already covers *.pem, *.key, *.p12 and *.pfx, but the file carries a .tmp extension so none of those patterns matched it. History was checked before removing the local copy: no commit touches that path and no object in any ref contains the key body, so the key was never exposed and needs no rotation. The live copy is the githubAppPrivateKey entry in the flux-system Secret, which is what Flux authenticates with -- verified by comparing SHA-256 of both, 1679 bytes and identical. --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index ae589f32..25391584 100644 --- a/.gitignore +++ b/.gitignore @@ -64,6 +64,9 @@ acme.json *.pfx .vault-keys .vault-app-secrets +# GitHub App private key, pasted out of the App settings page during setup. +# It carries no key/pem extension, so the patterns above do not catch it. +app-pk.tmp # Cloud-init rendered output infra/cloud-init/cloud-init.rendered.yml