# OS / editor
.DS_Store
*.swp
*~
.idea/
.vscode/

# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
*.dec.yaml
*.decrypted.*
*.key
age.key
*.kubeconfig
kubeconfig

# IaC state / local runtime
.terraform/
*.tfstate
*.tfstate.*
.terraform.lock.hcl
*.tfvars
!*.example.tfvars

# Test / build artifacts
/results/
/reports/
*.junit.xml
coverage/