1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Build artifacts
/target
**/target
# Editor / tooling
/.idea
/.vscode
*.swp
*.swo
*.log
# Cargo.lock IS committed, despite this being a library.
#
# The usual advice (cargo FAQ) is that libraries omit it, because downstream
# consumers ignore it anyway. That advice assumes CI has nothing that pins
# exact dependency versions. This repo does: `cargo vet` is a *blocking* job
# and its exemptions in supply-chain/ pin exact versions. With no committed
# lockfile CI resolved dependencies fresh on every run, so any transitive
# release turned vet red at a moment nobody chose -- twice in one hour during
# the 3.6.0 release alone.
#
# Committing the lockfile makes dependency updates deliberate: `cargo update`
# and the matching `cargo vet regenerate exemptions` land in the same reviewed
# commit. Downstream consumers are unaffected.
# Local test / coverage output
/coverage
*.profraw
*.profdata
# JUnit XML output from `cargo nextest` / similar; blocks `cargo publish`
# from a clean tree if left in the working directory.
junit.xml
# OS cruft
.DS_Store
Thumbs.db
# Secrets (never commit)
*.pem
*.key
!tests/**/*.pem
!tests/**/*.key
# Agent / planning scratchpad (not part of the crate)
/.sisyphus/
/.omo/
# Local code-review reports (working artifacts; not shipped in the crate)
/docs/reviews/