fix(gitignore): ignore suffixed age key backups

[Tanguille]

age.key.bak-x25519-only was sitting untracked in this public repo.

gh repo view          -> {"isPrivate": false}
git check-ignore -v age.key.bak-x25519-only   -> no match
git add -A --dry-run  -> add 'age.key.bak-x25519-only'
git log --all -- age.key.bak-x25519-only      -> never committed

.gitignore had *.key and /age.key; the filename ends -only so neither matched. Verified by decryption that this key opens the tracked sops files.

Nothing leaked. It was one git add -A away.

age.key* also makes the existing /age.key redundant, so that line is removed rather than left dead.

Summary by CodeRabbit

• Chores
  • Updated ignore rules to exclude backup and variant files associated with age.key, helping prevent them from being tracked accidentally.

[coderabbitai]

📝 Walkthrough

Walkthrough

The .gitignore rule changes from /age.key to age.key*. The new pattern also ignores suffixed backup files, including age.key.bak-x25519-only.

Changes

Ignore pattern update

Layer / File(s)	Summary
Update age.key ignore rule .gitignore	The ignore rule now uses age.key* and includes explanatory comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the change to ignore suffixed age key backup files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gitignore-age-key-backups

---

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 6ac1a8b...1c77a1b on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 2, 2026 3:02p.m.	Review ↗
Shell		Aug 2, 2026 3:02p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.gitignore:
- Around line 5-7: Update the age key ignore rule from age.key* to /age.key* so
matching key files and backups remain limited to the repository root, preserving
the existing protection against suffixed backups.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 50dbc110-76f7-4ef9-9879-067d377508a3

📥 Commits

Reviewing files that changed from the base of the PR and between 6ac1a8b and 1c77a1b.

📒 Files selected for processing (1)

• .gitignore

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• Tanguille/LLMKube (auto-detected)
• Tanguille/toolhive (auto-detected)
• Tanguille/pr-reviewer-action (auto-detected)
• Tanguille/2x-R9700-RDNA4-GFX1201-sglang-inference (auto-detected)

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Preserve the repository-root scope.

The previous /age.key rule matched only the repository root. The new age.key* pattern matches files and directories with that basename at any directory level. Use /age.key* if only root-level age key files and backups must be ignored.

Proposed fix

-age.key*
+/age.key*

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	# `*.key` misses suffixed backups like age.key.bak-x25519-only, which decrypt the
	# tracked sops files in this PUBLIC repo. Supersedes the old `/age.key`.
	age.key*
	# `*.key` misses suffixed backups like age.key.bak-x25519-only, which decrypt the
	# tracked sops files in this PUBLIC repo. Supersedes the old `/age.key`.
	/age.key*

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.gitignore around lines 5 - 7, Update the age key ignore rule from age.key*
to /age.key* so matching key files and backups remain limited to the repository
root, preserving the existing protection against suffixed backups.

[github-actions]

AI Automated Review

Analysis engine: qwen-3.6-fast@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation: Approve

This is a targeted, low-risk .gitignore fix that strengthens secret protection in this public repository. The change replaces the exact-match /age.key entry with the glob age.key*, ensuring suffixed backup keys (e.g., age.key.bak-x25519-only) are also ignored. This directly addresses the gap identified in the PR body where *.key did not match filenames ending in -only.

Change-by-Change Findings

• .gitignore: Replaced /age.key with age.key* and added explanatory comments.
  • The new pattern correctly covers age.key, age.key.bak, age.key.bak-x25519-only, etc.
  • The existing *.key rule already ignores most key files, but as noted, it fails for filenames like age.key.bak-x25519-only because the suffix breaks the *.key match. The explicit age.key* fills this gap.
  • Removing the redundant /age.key line keeps the file clean.
  • No other files are affected.

Standards Compliance

• AGENTS.md: Complies with "Never: Commit secrets or age.key (no exceptions)." This change enforces that rule more robustly by catching backup variants that could otherwise be accidentally committed.
• Conventional Commit: Title fix(gitignore): ignore suffixed age key backups follows the required format.
• Scope: Change is small, focused, and preserves unrelated content.

Tool Harness Findings

Tool harness planning was pending; no findings to report.

Unknowns or Needs Verification

None. The change is self-contained and verifiable from the diff and repository standards.