chore: purge committed backend/venv from version control (coverage + static-analysis hygiene)

PR
5mo ago
+3-1083980

Purge committed Python virtualenv (backend/venv/) from version control

Part of the quality-zero-platform drive-to-zero campaign (fleet-quality hygiene).

What this does

Removes the accidentally-committed Python virtualenv at backend/venv/ — 8,724 tracked files — from version control, and hardens .gitignore.

Why

  1. Coverage denominator pollution. The committed site-packages/ is third-party library code that gets counted as project source, deflating/distorting coverage metrics.
  2. Static-analysis noise. It generates ~33 spurious CodeQL / static-analysis alerts on vendored third-party code that isn't part of this project.

Removing the venv from tracking is a high-impact, low-risk cleanup: it touches no first-party application code.

Why it was still tracked

.gitignore already had a bare venv/ rule, but the venv files were committed before that rule existed — .gitignore only affects untracked files, so Git kept tracking them. This PR runs an explicit git rm -r backend/venv and hardens the ignore rules:

venv/
.venv/
backend/venv/
**/site-packages/

Scope / safety

  • Only backend/venv/ is removed (it was the single tracked virtualenv in the repo — confirmed via pyvenv.cfg / site-packages/ search). No first-party code, tests, or config changed.
  • No genuine secret or project config file was among the removed files. The only venv-specific config is backend/venv/pyvenv.cfg (local machine paths + Python version — benign).

Out of scope: leaked Azure Entra ID token

This PR does NOT address the separately-flagged leaked Azure Entra ID token. That secret does not live inside the venv, so purging the venv neither removes nor rotates it. Operator rotation of that token is still required and is being handled separately.

Note: this removes the venv from HEAD going forward. The files remain in Git history; a history rewrite (if desired) is a separate operation.

Summary by cubic

Removed the accidentally committed Python virtualenv at backend/venv/ and hardened .gitignore to prevent tracking of virtualenvs and site-packages. This fixes coverage pollution and removes noisy static-analysis alerts from third-party code.

  • Refactors
    • Deleted backend/venv/ from version control.
    • Added ignores: venv/, .venv/, backend/venv/, **/site-packages/.