The Critical Role of .gitignore in Production Repositories
A well-maintained .gitignore file is the first line of defense in software security and repository hygiene. It prevents build artifacts (dist/, build/), dependency caches (node_modules/, target/, venv/), and environment secrets (.env, *.pem) from entering version control.
Committing temporary files not only bloats Git repository clone sizes but can also accidentally expose API keys and database credentials to public or third-party collaborators.
Essential .gitignore Globbing Pattern Syntax
| Pattern | Matching Behavior | Example Match |
|---|---|---|
| node_modules/ | Ignores any directory named node_modules at any folder level. | /node_modules, /packages/api/node_modules |
| *.log | Ignores all files ending with the .log extension. | debug.log, server.error.log |
| !important.log | Whitelists / tracks important.log even if *.log was previously ignored. | important.log (Tracked) |
| build/**/debug.json | Matches zero or more intermediate subdirectories inside build/. | build/v1/debug.json, build/a/b/c/debug.json |
| /dist | Matches dist folder located ONLY at the root of the repository. | /dist (root only, not /apps/web/dist) |
Frequently Asked Questions
Why is Git still tracking files I added to .gitignore?
If a file was already committed to Git before being added to .gitignore, Git continues tracking it. To fix this, un-track the cache by running git rm -r --cached . followed by git add . and committing the change.
Should I commit .env.example files?
Yes! Always ignore actual secret files (.env, .env.local, .env.production) while committing a sanitized .env.example with placeholder values to document required variables for teammates.