From 31e882b15ca6cf2afa84099c8ee9f5a48e073679 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 6 Aug 2026 13:09:26 +0000
Subject: [PATCH] fix: stop ignoring the tracked Cargo.lock, unblinding the
 deps scanner (#108)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

.gitignore listed Cargo.lock under "Global build artifacts". The file is
tracked, so git exempts it and the rule is inert — git status clean,
nothing visibly wrong. osv-scanner matches .gitignore patterns directly
without modelling that exemption, so it skipped the repo's only lockfile
and reported "0 Extract calls / No package sources found". With
--allow-no-lockfiles that became exit 0: a hard-fail lane, green, having
scanned nothing.

Removed from all three places, since editing the file alone would be
undone by the next `gen-config`:
  - .gitignore itself
  - generate_full_gitignore()'s template
  - the --minimal ignorable_patterns list, which produced the current file

Deliberately NOT regenerating via `xtask gen-config`. The checked-in
.gitignore contains sections that appear in neither generator (Trunk,
hooksmith events, .direnv, .config), so a regeneration would drop
content nobody asked to lose. The three edits are equivalent for the one
line at issue and leave the rest untouched.

THE FIRST HONEST SCAN WILL BE RED. Queried against OSV: 25 of the 535
packages carry advisories, incl. wasmtime 18.0.4 (28) and git2 0.18.3
(4). That is the point of the change — the advisories were already
there, only the reporting was wrong — but the remediation is a separate
project, not this diff.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0112uYAfDFCMvNu9ShenfYcr
---
 .gitignore               | 1 -
 crates/xtask/src/main.rs | 9 ++++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 6438c8e..6791537 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,6 @@
 
 # Global build artifacts
 target/
-Cargo.lock
 
 # Global temporary and log files
 *.tmp
diff --git a/crates/xtask/src/main.rs b/crates/xtask/src/main.rs
index c7b97e8..8de0c8c 100644
--- a/crates/xtask/src/main.rs
+++ b/crates/xtask/src/main.rs
@@ -10547,7 +10547,6 @@ fn generate_full_gitignore() -> Result<String> {
 # Rust build artifacts
 ############################
 /target/
-Cargo.lock
 
 ############################
 # IDE & editor
@@ -10676,9 +10675,13 @@ fn generate_canonical_gitignore() -> Result<String> {
 
     // Define known ignorable patterns that should be included if they exist in the tree
     let ignorable_patterns = vec![
-        // Rust build artifacts
+        // Rust build artifacts. Cargo.lock is deliberately absent: this is a
+        // workspace with a COMMITTED lockfile, and ignoring a tracked file is
+        // inert for git but not for tools that match .gitignore patterns
+        // directly — osv-scanner skipped it and reported green having scanned
+        // nothing for months (#108). The entry was a default carried over from
+        // the library case, where Cargo.lock genuinely is not committed.
         ("target", "/target/"),
-        ("Cargo.lock", "Cargo.lock"),
         // IDE & editor
         (".vscode", ".vscode/"),
         (".idea", ".idea/"),