From c03d7e3044e0d3a36c8a9939f13bbe28d3a2c444 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Mon, 1 Jun 2026 22:31:43 +0000
Subject: [PATCH] fix(ci): allow .claude/commands/ to be committed

The semgrep rule blocking .claude/ was intended to prevent local settings
files from being committed. Commands (skills) in .claude/commands/ are
meant to be shared project-wide, so we exclude them from this rule.

https://claude.ai/code/session_01J75nfVUa4uStAWJr5s168o
---
 .semgrep/rules/security/no-claude-directory.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.semgrep/rules/security/no-claude-directory.yml b/.semgrep/rules/security/no-claude-directory.yml
index 7d120a7c23c..bb80a6af22b 100644
--- a/.semgrep/rules/security/no-claude-directory.yml
+++ b/.semgrep/rules/security/no-claude-directory.yml
@@ -1,16 +1,18 @@
 rules:
   - id: no-claude-directory-committed
     message: >
-      .claude/ directory must not be committed to the repository.
-      It contains local Claude Code settings (permissions, worktree paths) that are
+      .claude/ settings files must not be committed to the repository.
+      They contain local Claude Code settings (permissions, worktree paths) that are
       developer-machine-specific and may expose internal paths or credentials.
-      Add .claude/ to .gitignore instead.
+      Add .claude/settings*.json to .gitignore instead.
     severity: ERROR
     languages: [generic]
     paths:
       include:
         - "/.claude/**"
         - "/.claude/*"
+      exclude:
+        - "/.claude/commands/**"
     pattern-regex: '[\s\S]+'
     metadata:
       category: security