# AI Software Factory — Docker build-context ignore (TASK-0134).
#
# Every app image is built with the REPO ROOT as the build context (see
# apps/*/Dockerfile — `docker build -f apps/<app>/Dockerfile <repo-root>`).
# Without a .dockerignore, `COPY . .` (apps/worker/Dockerfile) — and the
# explicit COPYs in the other images — would ship the following INTO the
# image: the real `.env` (live dev/CI credentials), the entire `.git`
# history (every secret ever committed), `node_modules/`, and build output.
# That is a secret-exposure finding (ASVS L2 §7.x / secret-scan-of-images).
#
# This file keeps the context lean AND secret-free. `.env.example` is kept
# OUT on purpose — it documents, never contains, credentials; nothing in an
# image needs it.

# --- secrets (never in an image) ---
.env
.env.*
!.env.example
*.pem
*.key
*.p12
*.pfx
id_rsa*
id_ed25519*
secrets/
**/secrets/

# --- version control (history = every secret ever committed) ---
.git
.gitignore
.gitattributes

# --- dependencies + build output (rebuilt inside the image) ---
node_modules
**/node_modules
dist
**/dist
.next
**/.next
out
**/out
build
**/build
.turbo
**/.turbo
coverage
**/coverage

# --- local tool caches / scratch / OS cruft ---
.pnpm-home
.pnpm-store
.dsh-scratch
.dsh-pnpm-env.sh
**/.cache
**/.parcel-cache
*.log
logs
npm-debug.log*
.DS_Store
Thumbs.db

# NOTE: `tests/` and `packages/` are intentionally NOT excluded — the
# Dockerfiles run `pnpm install` at the monorepo root, and pnpm-workspace.yaml
# lists them as literal workspace members (excluding them breaks the build).
# Test fixtures use the reserved `*_test_*` secret syntax, which gitleaks
# allowlists by pattern, so they carry no live credentials.