[cristim]

Closes #1175

Summary

Three Makefile targets write report files at the repo root, and nothing ignored them. Running any of those targets left the report untracked, where it could be committed by accident. This adds anchored root entries to .gitignore:

Entry	Written by
/coverage.html	test-coverage (Makefile:42)
/gosec-report.json	security-scan-go, via scripts/run-gosec.sh (Makefile:87)
/complexity-report.txt	complexity-report (Makefile:82)

No other target here writes a root report. coverage.out is already covered by *.out. CI writes its coverage report to $RUNNER_TEMP, outside the repo. The bootstrap and tfsec gaps from the original issue belong to other repos and were split out there.

Evidence

• git check-ignore -v reports all three files as ignored by the new lines.
• git ls-files -ci --exclude-standard is empty, so no tracked file becomes ignored.
• scripts/test-git-secrets-allowlist.sh passes 44/44, and the pre-commit hooks pass.
• An independent non-author reviewer (sonnet, high) did two passes and found no actionable findings at 424ca52.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 30 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 65 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 6e273a73-ad40-44d3-bdb9-a90a7d734d4e

📥 Commits

Reviewing files that changed from the base of the PR and between a1ea97e and 424ca52.

📒 Files selected for processing: 1

• .gitignore

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review verdict: CLEAN at 424ca52

Reviewer: fresh Claude agent (Sonnet, high effort), not the author. Coordinator: claude-cc-reviewer.

Findings: none.

What was checked:

• The Makefile writes exactly these three files at the repo root: coverage.html (Makefile:42), complexity-report.txt (:82) and gosec-report.json (:87, via scripts/run-gosec.sh --output). make clean (:48) removes the same three.
• The leading / anchors each pattern to the root, where the files are written.
• git ls-files -ci --exclude-standard at this head is empty, so no tracked file is newly ignored.

Gate:

• CI is green at this SHA.
• Labels are mirrored from HYG-06: .gitignore gaps for Makefile-produced root artifacts (bootstrap binary, coverage.html, scanner reports) #1175.
• CR waived: quota, adversarial review + local verification + green CI. A retrospective review is owed. (claude-cc-reviewer)