This repository now treats credentials and host-local state as non-versioned.

These files are intentionally ignored by Git and should stay local-only:

• config/gh/hosts.yml
• config/msmtp/config
• ssh/id_*
• ssh/*.pub
• ssh/known_hosts
• ssh/known_hosts.old

Because credentials were previously tracked, rotate them before any push.

1. Revoke old token in GitHub settings:
   • https://github.com/settings/tokens
2. Re-authenticate CLI:
   • gh auth logout -h github.com
   • gh auth login -h github.com --git-protocol ssh --web
   • gh auth status

If your private key lived under this repo path, rotate it:

ssh-keygen -t ed25519 -C "domogami@gmail.com" -f ~/.ssh/id_ed25519_github
ssh-add ~/.ssh/id_ed25519_github
cat ~/.ssh/id_ed25519_github.pub

Add the public key at https://github.com/settings/keys and remove old keys.

Use:

./scripts/migrate_ssh_out_of_repo.zsh

This script:

• Creates a real ~/.ssh directory from your current symlinked contents
• Preserves a timestamped backup
• Re-links only ~/.ssh/config to ssh/config in this repo

Run before each push:

git status --short
git diff --cached --name-only | rg -i "(hosts\\.yml|id_ed25519|id_rsa|token|secret|password|credentials|\\.pem$|\\.key$)" || true

This repo ships a pre-commit hook at .githooks/pre-commit.

1. Install scanner:
   • brew install gitleaks
2. Ensure hooks are enabled:
   • ./install (automatically sets core.hooksPath=.githooks)
   • or manually: git config core.hooksPath .githooks
3. Commit normally; staged changes are scanned for secrets before commit completes.