[ptr727]

Summary

Brings the local runtime credential directory in line with GOVERNANCE.md "Repo-Scoped Secrets". The fleet audit does not detect this, since the directory is untracked, so the maintainer found it by reading the tree.

• .gitignore: the bare secrets/ ignore is replaced by the convention's three-line .secrets/ pattern.
• .secrets/immich_api_key.example and a .secrets/README.md catalog are tracked.
• .vscode/launch.json "Trash DB" reads ${workspaceFolder}/.secrets/immich_api_key, extensionless per the rule.
• OPERATIONS.md "Configuration Layout" and GOVERNANCE.md "Repository Layout" list the directory.

Local step for any other checkout: move secrets/immich_api_key.txt to .secrets/immich_api_key, then delete secrets/. After this merges the old path is no longer ignored. The maintainer's primary checkout has already been moved.

Verification

• git check-ignore confirms a real .secrets/<name> is ignored while the .example and catalog stay tracked.
• Hub prose gate, markdownlint and cspell are clean locally.
• A local strict review (agent-skill, frontier tier) ran two rounds. It fixed two wording errors in the catalog. It moved the legacy-path risk into the step above rather than keep a bare secrets/ ignore.

🤖 Generated with Claude Code

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0b820a49-a72b-4f0c-ac5b-54443a9f46fe

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[ptr727]

A recorded local strict-review pass covers head 843bc71db26257b011bcbe2c4dc02801d3e8a6e2, the content this pull request carries at that commit against develop, and it recorded 3 findings.

[ptr727]

A recorded local strict-review pass covers head d7eb23bc4d1117abec5b3ab58174538200b102c3, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[Copilot]

🟡 Changes recommended

A critical security gap remains because .secrets is not excluded from Docker build contexts, with an additional README ambiguity about secret paths.

1 open issue

• Clarify the README and Compose secret paths · New

What changed in this PR

This pull request moves local Immich runtime credentials from the legacy secrets/ path to the repo-scoped .secrets/ convention, updating configuration, ignore rules, and documentation.

Changes:

• Replaces the broad secrets/ ignore rule with standardized .secrets/ patterns.
• Updates the VS Code Trash DB configuration to use .secrets/immich_api_key.
• Adds a tracked credential example and catalog.
• Documents the new layout in OPERATIONS.md and GOVERNANCE.md.
• Requires excluding .secrets/ from Docker build contexts and clarifying the README’s /run/secrets/ reference.

This pull request requires changes.

File	Summary
OPERATIONS.md	Documents the repo-scoped secrets directory and tracked-file policy.
GOVERNANCE.md	Adds .secrets/ to the repository layout.
.vscode/​launch.json	Points the Trash DB configuration to .secrets/immich_api_key.
.secrets/​README.md	Catalogs the local credential and requires clarification between host and container secret paths.
.secrets/​immich_api_key.example	Provides the tracked placeholder credential file.
.gitignore	Ignores real .secrets/ files while allowing examples and the catalog.

_{Review effort: Lite}