chore: keep tool configuration out of the repository root

[yordis]

• A root crowded with per-tool dotfiles hides the files a reader actually looks for there, so tool configuration gets one home in .config/, mirroring the XDG ~/.config convention.
• .config/AGENTS.md records the convention so new tool configs land there instead of drifting back to the root.

[cursor]

PR Summary

Low Risk
Changes only affect where CI/lint tools load config and workflow path filters; no application or security logic is modified beyond pointing gitleaks at the same rules in a new path.

Overview
Moves lint and security tool configuration under .config/ (XDG-style) and documents the convention in new .config/AGENTS.md, including naming rules and how to wire tools that do not auto-discover that directory.

Mise tasks under .config/mise/tasks/github/workflows/ now pass explicit --config paths for gitleaks, chart-testing (ct), hadolint, lychee, markdownlint-cli2, taplo, and typos so local and CI runs use the same files. The Infra GitHub workflow paths: filters were updated from root .hadolint.yaml and ct.yaml to .config/hadolint.yaml and .config/ct.yaml.

^{Reviewed by Cursor Bugbot for commit 6da9f9f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ffc5476d-6265-4c4d-a883-c46b6f7a3058

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 376f2b8 and 6da9f9f.

---

---

📒 Files selected for processing (17)

• .config/AGENTS.md
• .config/ct.yaml
• .config/gitleaks.toml
• .config/hadolint.yaml
• .config/lychee.toml
• .config/markdownlint-cli2.yaml
• .config/mise/tasks/github/workflows/gitleaks/scan
• .config/mise/tasks/github/workflows/infra/ct-lint
• .config/mise/tasks/github/workflows/infra/hadolint
• .config/mise/tasks/github/workflows/lint/lychee-full
• .config/mise/tasks/github/workflows/lint/lychee-offline
• .config/mise/tasks/github/workflows/lint/markdownlint
• .config/mise/tasks/github/workflows/lint/taplo
• .config/mise/tasks/github/workflows/lint/typos
• .config/taplo.toml
• .config/typos.toml
• .github/workflows/infra.yml

---

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

---

Walkthrough

Repository guidance now describes tool configuration locations under .config/. Mise tasks pass explicit paths to those configurations, and infrastructure workflow filters watch the updated Hadolint and chart-testing paths.

Changes

Configuration path updates

Layer / File(s)	Summary
Document and use tool configuration paths .config/AGENTS.md, .config/mise/tasks/github/workflows/{gitleaks/scan,infra/*,lint/*}	Adds guidance for configuration locations and updates Gitleaks, chart-testing, Hadolint, Lychee, markdownlint, Taplo, and typos tasks to use explicit .config/ paths.
Update infrastructure workflow filters .github/workflows/infra.yml	Updates push and pull-request path filters to watch .config/hadolint.yaml and .config/ct.yaml.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 6da9f

Tool configuration paths are consistently centralized under .config/ and remain reachable by the repository workflows.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely summarizes the main change: moving tool configuration out of the repository root.
Description check		The description directly explains the move to .config/ and the addition of guidance for future tool configurations.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{I’m a rabbit with configs tucked neat,
In .config/, the paths now meet.
I hop through tasks and checks all day,
While workflow filters find the way.
My carrots rest beside the files,
I nibble, then dash off for miles!}

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6da9f9f. Configure here.}