# Code-eval runners are Lambda handler test fixtures (Node + Python). They
# intentionally execute user-supplied evaluator source via `exec` / dynamic
# `import` and talk to a locally-provisioned Floci endpoint from
# `urllib.request.urlopen`. Both are by design and inherent to the runner
# contract — scanning them produces noise, not signal.
scripts/code-eval-runners/

# Generated by `gh aw compile` from the sibling .md. gh-aw injects the OTLP
# credential into the workflow-level env by design (every job exports spans),
# either from the workflow's own observability config or, since gh-aw v1, from
# the GH_AW_DEFAULT_OTLP_* secrets. That trips semgrep's gha-workflow-env-secret
# rule. .semgrepignore is path-only, so the whole file is skipped; list further
# traced *.lock.yml files here individually rather than widening to a glob.
.github/workflows/bedrock-model-api-formats.lock.yml
.github/workflows/ci-runtime-analyst.lock.yml
.github/workflows/dependabot-security-maintainer.lock.yml

# cargo-about templates rendering the plain-text license notices shipped in the
# Rust images at build time. Triple braces keep crate names and license texts
# from being HTML-escaped; the output is never served as HTML, so the mustache
# explicit-unescape XSS rule does not apply.
ai-gateway/about.hbs
packages/native/about.hbs

# claude.ai/design sync build tooling, run locally by /design-sync and never
# deployed. story-imports.mjs builds its package-matching regex from
# escaped config values, which trips detect-non-literal-regexp.
.design-sync/
