42 lines
904 B
Plaintext
42 lines
904 B
Plaintext
# OS / editor
|
|
.DS_Store
|
|
*.swp
|
|
*~
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
|
|
*.dec.yaml
|
|
*.decrypted.*
|
|
*.key
|
|
age.key
|
|
*.kubeconfig
|
|
kubeconfig
|
|
|
|
# IaC state / local runtime
|
|
.terraform/
|
|
*.tfstate
|
|
*.tfstate.*
|
|
.terraform.lock.hcl
|
|
*.tfvars
|
|
!*.example.tfvars
|
|
# tofu apply/plan run logs (tee'd locally; never commit)
|
|
apply.log
|
|
plan.log
|
|
|
|
# Test / build artifacts
|
|
/results/
|
|
/reports/
|
|
*.junit.xml
|
|
coverage/
|
|
|
|
# Tofu remote-state secrets (R2 creds + encryption passphrase + account-specific backend cfg).
|
|
# The *.example templates ARE committed; the real files are not.
|
|
infra/tofu/backend.hcl
|
|
infra/tofu/.r2.env
|
|
|
|
# Claude Code local scratch: agent worktrees + session state. Nothing here is tracked;
|
|
# ignoring it keeps `git add -A` from staging embedded worktree repos and keeps the lint
|
|
# stage (which scans untracked files) from tripping on .claude/worktrees/.
|
|
.claude/
|