release: v0.3.0

.github/workflows/ci.yml

@@ -6,14 +6,19 @@ on:
   pull_request:
     branches: [main, dev]
 
+# Workflow-level least privilege. CI doesn't need to write to the repo,
+# create issues, or push container images — read-only is enough.
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: 22
           cache: npm
@@ -27,13 +32,13 @@ jobs:
           shellcheck frontend/public/install.sh
           shellcheck frontend/public/scripts/uconsole
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: '3.11'
 
       - name: Device tests (pytest)
         run: |
-          pip install pytest
+          pip install pytest pyflakes
           python -m pytest tests/ -v
 
       - name: Shell script checks
@@ -60,15 +65,15 @@ jobs:
     needs: ci
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Set up QEMU (arm64 emulation)
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3
         with:
           platforms: arm64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
 
       - name: Build .deb
         run: bash packaging/build-deb.sh
@@ -78,7 +83,7 @@ jobs:
           docker buildx build \
             --platform linux/arm64 \
             --load \
-            -f Dockerfile.test \
+            -f packaging/Dockerfile.test \
             -t uconsole-test .
 
       - name: Verify test image

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Extract version from tag
         id: version
@@ -29,7 +29,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: 22
           cache: npm
@@ -69,7 +69,7 @@ jobs:
           echo "Built: $DEB ($(du -h "$DEB" | cut -f1))"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
         with:
           files: dist/uconsole-cloud_*.deb
           generate_release_notes: true

.gitignore

@@ -22,12 +22,17 @@ dist/
 # APT repo — pool/ and dists/ are generated by `make publish-apt` but MUST be
 # committed so Vercel deploys them. Only the private GPG key is excluded (below).
 
-# GPG private keys (NEVER commit)
+# Secrets — defensive patterns. No tracked files match these today; the
+# patterns are here so an accidental `git add .` can't drag credentials in.
 *-private.gpg
+*.pem
+*.key
+id_*
+secrets/
+.config/op/
 
 # misc
 .DS_Store
-*.pem
 
 # debug
 npm-debug.log*
@@ -42,13 +47,29 @@ yarn-error.log*
 # vercel
 .vercel
 
-# claude code project memory
+# AI tooling — not for OSS source. CLAUDE.md and per-IDE Claude/agent
+# scratch dirs stay local-only.
 CLAUDE.md
+AGENTS.md
+GEMINI.md
+.claude/
+.cursor/
+.copilot/
+.continue/
+.aider*
 
 # typescript
 *.tsbuildinfo
 next-env.d.ts
 __pycache__/
+.pytest_cache/
 
 # user TUI preferences (theme, view mode)
 device/scripts/.console-config.json
+
+# device backups — these live in the private ~/pkg repo, never in this public
+# one. If backup.sh ever gets re-introduced or run from the wrong tree, these
+# patterns keep credentials out of git.
+device/scripts/system/wifi/
+device/scripts/system/etc/shadow
+device/scripts/system/etc/sudoers.d/