diff --git a/.gitignore b/.gitignore
index e5fc12f..3acc38c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /target
 .envrc
 .worktrees/
+.claude.local.md
diff --git a/CLAUDE.md b/CLAUDE.md
index 9203f83..9c811f8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -66,3 +66,8 @@ Orchestrates in order: prereqs check → load config → clone dotfiles → age
 ## Edition
 
 Rust edition 2024. All hook scripts are Nushell (`.nu`) — no `.sh` scripts.
+
+## CI / Gitea Actions
+
+Workflows live in `.gitea/workflows/` — mirrors `.github/workflows/` for GitHub.
+The `public-ready.yml` workflow checks secrets, private IPs, licenses, and tracked secrets files on every push to main.