ci: grant contents write permission for mirror push

.gitea/workflows/mirror.yml

@@ -8,6 +8,9 @@ concurrency:
   group: mirror
   cancel-in-progress: true
 
+permissions:
+  contents: write
+
 jobs:
   mirror:
     runs-on: ubuntu-latest

.github/workflows/mirror.yml

@@ -8,6 +8,9 @@ concurrency:
   group: mirror
   cancel-in-progress: true
 
+permissions:
+  contents: write
+
 jobs:
   mirror:
     runs-on: ubuntu-latest
@@ -19,4 +22,4 @@ jobs:
       - name: Reconcile with Gitea
         run: bash scripts/mirror.sh
         env:
-          MIRROR_URL: https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.weown.tools/Wursor/s004.git
+          MIRROR_URL: https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.weown.tools/pat/wursor.git

.gitignore

@@ -1,8 +1,37 @@
 .DS_Store
+node_modules/
+
+# Secrets — never commit real credentials, keys, or tokens.
 .env
 .env.*
 !.env.example
-node_modules/
+.envrc
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+*.jks
+*.keystore
+id_rsa
+id_rsa.*
+id_ed25519
+id_ed25519.*
+id_ecdsa
+id_ecdsa.*
+*.token
+credentials.json
+credentials*.json
+service-account*.json
+secrets.json
+secrets*.json
+.netrc
+.npmrc
+*.tfvars
+!.tfvars.example
+.terraform/
+*.tfstate
+*.tfstate.*
 .wp-env/
 vendor/
 dist/