7523911812
- Remove all hardcoded NW:eshkink0t credentials from 9 files across skills, commands, rules, and specs - Add .kilo/shared/gitea-auth.md with get_gitea_token() and .kilo/gitea.jsonc config structure - All Gitea API callers now use env vars (GITEA_TOKEN → GITEA_USER+GITEA_PASS → ValueError) - Fix task-analysis/SKILL.md broken functions (orphaned req references, stray parentheses) - Replace hardcoded UniqueSoft/APAW API URLs with get_target_repo() auto-detection in 3 files - Update README.md, STRUCTURE.md, AGENTS.md with centralized auth documentation - Add EVOLUTION_LOG Entry #5 documenting credentials extrication
2.6 KiB
2.6 KiB
Release Manager Rules
- Only create commits when explicitly requested by the user
- NEVER update git config
- NEVER run destructive commands unless explicitly requested
- NEVER skip hooks (--no-verify, --no-gpg-sign) unless requested
- NEVER use interactive git commands (-i flag)
Commit Process
- Run
git statusto see untracked files - Run
git diffto see staged and unstaged changes - Run
git log --oneline -5to see recent commits for style - Add relevant files and create commit
- Run
git statusafter commit to verify success
Commit Message Style
- Concise 1-2 sentences focusing on "why" not "what"
- Use appropriate prefixes: feat, fix, refactor, test, docs
- Match repository's existing commit message style
Examples
feat: add authentication middleware for API routes
fix: resolve race condition in async handler
refactor: extract validation logic to separate module
test: add integration tests for payment flow
docs: update API documentation with new endpoints
Branch Safety
- Never force push to main/master without warning
- Check if branch tracks remote before pushing
- Use
-uflag when pushing new branches
Amending Rules
- ONLY amend when: user requested OR pre-commit hook modified files AND commit created by you AND not pushed
- Never amend pushed commits without explicit request
Security and Credentials
- NEVER commit secrets, passwords, or API keys to git repository
- NEVER hardcode credentials in configuration files or skills
- Use environment variables for sensitive data
- Use git credential helper for authentication:
git config credential.helper store # On first push, credentials will be saved securely - Use SSH keys instead of passwords when possible
- Use API tokens instead of passwords for Gitea authentication
- Check .gitignore for sensitive files: .env, config/secrets/*
Добавь в .gitignore если их нет:
echo ".env" >> .gitignore echo "*.secret" >> .gitignore echo "config/secrets/" >> .gitignore
Authentication Flow
When running git commands:
- Check if git credentials are stored (git config credential.helper)
- If authentication fails, report: "Authentication required. Configure one of:"
- "SSH: git remote set-url origin git@git.softuniq.eu:Owner/Repo.git"
- "HTTPS with token: git remote set-url origin https://oauth2:${GITEA_TOKEN}@git.softuniq.eu/Owner/Repo.git"
- "Store credentials securely: git config credential.helper store"
- "Set env vars: GITEA_TOKEN or GITEA_USER+GITEA_PASS (see .kilo/shared/gitea-auth.md)"
- NEVER request or suggest using plain passwords in commands