feat(templates): scaffold a .gitignore that excludes .env and .venv

[michaelxu2288]

What

agentex init writes .env.example and tells users to create .env with an API key. .dockerignore protects the image build, but no template ships a .gitignore, so git init && git add . in a scaffolded folder commits .env (and .venv). Adds a .gitignore.j2 to all 19 templates (secrets, Python artifacts, tool caches; .env.example stays committable), registers it in root_templates in commands/init.py, and adds a parametrized test asserting every scaffold renders it with .env and .venv/ excluded.

Test

tests/lib/cli/test_init_templates.py: 45 passed (26 existing + 19 new). ruff clean.

Confidence Score: 4/5

The PR is not ready to merge while rerunning agentex init can make .env.example ignored.

Findings

1.  Gitignore Rule Order Breaks ▶

Fix with agent prompt

### Issue 1
src/agentex/lib/cli/commands/init.py:127-129
When an existing `.gitignore` already contains `!.env.example` but does not contain `.env.*`, this order-insensitive check skips the existing negation and appends `.env.*` after it. Git uses the last matching rule, so rerunning `agentex init` then ignores `.env.example` even though the scaffold promises that the example file remains committable. Preserve the template rules as an ordered block or otherwise account for their effective order when merging.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR adds .gitignore files to all 19 agentex init templates and makes task creation wait for its workflow to start. It also updates release and CI automation for a main-only production flow, adds security scan workflows, and points production clients at the hosted Agentex service.

• Keeps .env.example shareable while excluding local secrets, virtual environments, and Python tool files.
• Creates the GitHub release before opening the next release pull request, and updates guidance and workflows for main.
• Adds OpenGrep, TruffleHog, and Bandit workflow entry points.

_{Reviews (3) · Last reviewed commit: "fix(init): merge scaffold entries into a..."}

[greptile-apps]

Gitignore Rule Order Breaks

When an existing .gitignore already contains !.env.example but does not contain .env.*, this order-insensitive check skips the existing negation and appends .env.* after it. Git uses the last matching rule, so rerunning agentex init then ignores .env.example even though the scaffold promises that the example file remains committable. Preserve the template rules as an ordered block or otherwise account for their effective order when merging.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agentex/lib/cli/commands/init.py
Line: 127-129

Comment:
**Gitignore Rule Order Breaks**

When an existing `.gitignore` already contains `!.env.example` but does not contain `.env.*`, this order-insensitive check skips the existing negation and appends `.env.*` after it. Git uses the last matching rule, so rerunning `agentex init` then ignores `.env.example` even though the scaffold promises that the example file remains committable. Preserve the template rules as an ordered block or otherwise account for their effective order when merging.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Comments Outside Diff

These findings could not be posted inline.

•  Bandit findings stay hidden .github/workflows/bandit-ci.yml:91 ▶

  When the reporting endpoint is unset, this job says Bandit's findings are in the log. Both scans write to JSON files instead, and the job never prints or uploads them. Reviewers cannot see the findings even though the job passes. Print or upload the results when reporting is unavailable.