From e4a9a713b78cd22b51c0ebd1032b48a79543ca24 Mon Sep 17 00:00:00 2001
From: Aric Camarata <aric.camarata@gmail.com>
Date: Mon, 31 Aug 2026 09:01:03 -0400
Subject: [PATCH] chore(ci): add generated-file gate + normalize gitignore
 patterns

Closes P6-E11-W2-S2-T13 layers 1 and 3: adds .github/workflows/generated-file-gate.yml
and normalizes .gitignore to cover backend/docker-compose*.yml, *.generated.env,
**/*.gen.yml per the PPI Generated Files & Secret Safety hard rule.
---
 .github/workflows/generated-file-gate.yml | 59 +++++++++++++++++++++++
 .gitignore                                |  2 +
 2 files changed, 61 insertions(+)
 create mode 100644 .github/workflows/generated-file-gate.yml

diff --git a/.github/workflows/generated-file-gate.yml b/.github/workflows/generated-file-gate.yml
new file mode 100644
index 0000000..0be61ed
--- /dev/null
+++ b/.github/workflows/generated-file-gate.yml
@@ -0,0 +1,59 @@
+name: Generated File Gate
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  generated-file-gate:
+    name: Block committed generated files
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan diff for GENERATED BY markers
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch origin main --depth=1
+            BASE="origin/main"
+          else
+            BASE="${{ github.event.before }}"
+            if [ -z "$BASE" ] || ! git cat-file -e "$BASE" 2>/dev/null; then
+              BASE="HEAD~1"
+            fi
+          fi
+
+          CHANGED=$(git diff --name-only "$BASE"...HEAD || true)
+          if [ -z "$CHANGED" ]; then
+            echo "No changed files to scan."
+            exit 0
+          fi
+
+          FAIL=0
+          while IFS= read -r f; do
+            [ -f "$f" ] || continue
+            if head -n 5 "$f" | grep -q "# GENERATED BY"; then
+              if git check-ignore -q "$f"; then
+                echo "OK: $f is generated but gitignored."
+              else
+                echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
+                echo "  -> $f"
+                FAIL=1
+              fi
+            fi
+          done <<< "$CHANGED"
+
+          if [ "$FAIL" -eq 1 ]; then
+            echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
+            exit 1
+          fi
+
+          echo "Generated File Gate: clean."
diff --git a/.gitignore b/.gitignore
index e60d83b..aa9c54c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -171,3 +171,5 @@ android/app/build/
 *.hprof
 *.jks
 pnpm-lock.yaml
+*.generated.env
+**/*.gen.yml