shipit-litelisted

# shipit-lite A last look at what is about to leave the machine. Everything in a pushed commit is permanent for practical purposes: private repos go public later, force-pushed commits stay fetchable by SHA, and forks keep copies. Check before the first push, not after. ## Run the check ```bash bash scripts/pre-push-check.sh <<< '{"tool_input":{"command":"cd <repo> && git push"}}' ``` Or read its three checks and run them by hand. It scans only unpushed commits (`git log --branches --not --remotes`) for: 1. **Junk/scratch files** — scratch_*, tmp_*, sample_*, debug dumps, `*.log`, `.env`, caches, editor dirs, private keys (`*.pem`, `id_rsa*`). 2. **Secret-looking content** — provider key shapes (sk-ant-, sk-, AKIA, ghp_, gho_, github_pat_, xox., AIza), PRIVATE KEY blocks, and quoted 16+ char values assigned to api_key/secret/token/password. Lines using getenv/environ/dotenv or placeholders are excluded. 3. **AI co-author trailers** — Co-Authored-By lines naming Claude, Copilot, Cursor, Codex, GPT, Gemini, Devin, or Aider. Repos that deliberately keep attribution opt out with `git config shipit.allowAiTrailers true`. Clean output means clean. Findings mean fix first, push second. ## Fixing findings **Junk file, last commit only:** `git rm --cached <file>`, add a .gitignore entry, then `git commit --amend --no-edit`. **Junk file, older unpushed commits:** rewrite just the unpushed range: `git rebase -i` isn't available in Claude Code sessions; use `git