1# AI Software Factory — Docker build-context ignore (TASK-0134). 2# 3# Every app image is built with the REPO ROOT as the build context (see 4# apps/*/Dockerfile — `docker build -f apps/<app>/Dockerfile <repo-root>`). 5# Without a .dockerignore, `COPY . .` (apps/worker/Dockerfile) — and the 6# explicit COPYs in the other images — would ship the following INTO the 7# image: the real `.env` (live dev/CI credentials), the entire `.git` 8# history (every secret ever committed), `node_modules/`, and build output. 9# That is a secret-exposure finding (ASVS L2 §7.x / secret-scan-of-images). 10# 11# This file keeps the context lean AND secret-free. `.env.example` is kept 12# OUT on purpose — it documents, never contains, credentials; nothing in an 13# image needs it. 14 15# --- secrets (never in an image) --- 16.env 17.env.* 18!.env.example 19*.pem 20*.key 21*.p12 22*.pfx 23id_rsa* 24id_ed25519* 25secrets/ 26**/secrets/ 27 28# --- version control (history = every secret ever committed) --- 29.git 30.gitignore 31.gitattributes 32 33# --- dependencies + build output (rebuilt inside the image) --- 34node_modules 35**/node_modules 36dist 37**/dist 38.next 39**/.next 40out 41**/out 42build 43**/build 44.turbo 45**/.turbo 46coverage 47**/coverage 48 49# --- local tool caches / scratch / OS cruft --- 50.pnpm-home 51.pnpm-store 52.dsh-scratch 53.dsh-pnpm-env.sh 54**/.cache 55**/.parcel-cache 56*.log 57logs 58npm-debug.log* 59.DS_Store 60Thumbs.db 61 62# NOTE: `tests/` and `packages/` are intentionally NOT excluded — the 63# Dockerfiles run `pnpm install` at the monorepo root, and pnpm-workspace.yaml 64# lists them as literal workspace members (excluding them breaks the build). 65# Test fixtures use the reserved `*_test_*` secret syntax, which gitleaks 66# allowlists by pattern, so they carry no live credentials. 67