TECH **Git & GitHub: .gitignore & Global Exclude Rules – Zero-Fluff Study Guide**

Git & GitHub: .gitignore & Global Exclude Rules – Zero-Fluff Study Guide

1. What This Is & Why It Matters

A .gitignore file tells Git which files or patterns to ignore when tracking changes in a repository. A global exclude file does the same thing, but across all your local Git repos—no need to repeat rules in every project.

Why This Matters in Production

• Security: You never want to commit secrets (API keys, .env files, certificates) or sensitive data (logs, debug dumps). A misplaced .env in a public repo can lead to AWS account takeovers, database leaks, or ransomware attacks.
• Cleanliness: Ignoring build artifacts (node_modules/, *.log, *.pyc) keeps repos small, fast, and free of noise. A repo bloated with node_modules slows down git clone and git status.
• Consistency: If every developer ignores the same files (e.g., IDE configs like .vscode/), you avoid merge conflicts from irrelevant changes.
• Compliance: Some industries (finance, healthcare) require that certain files (e.g., *.pem, *.key) never enter version control.

Real-World Scenario

You inherit a legacy Python project. The repo is 1.2GB—mostly venv/, .DS_Store, and *.pyc files. git status takes 10 seconds to run. Your CI/CD pipeline fails because it’s trying to lint venv/bin/python. Fixing this starts with .gitignore.

2. Core Concepts & Components

3. Step-by-Step Hands-On

Prerequisites

• Git installed (git --version should work).
• A terminal (Bash, Zsh, or PowerShell).
• A test repo (or create one with git init).

Task 1: Create a .gitignore File

Goal: Ignore node_modules/, .env, and *.log in a Node.js project.

1. Navigate to your repo:
   bash
cd ~/projects/my-node-app
2. Create .gitignore:
   bash
touch .gitignore
3. Edit .gitignore (use nano, vim, or VS Code):
   bash
nano .gitignore
4. Add these rules:
   ```gitignore
   # Dependency directories
   node_modules/

# Environment variables
.env
.env.local
.env*.local

# Log files
*.log

# IDE/Editor files
.vscode/
.idea/

# OS metadata
.DS_Store
Thumbs.db
5. Verify it works:bash
touch .env test.log node_modules/dummy.js
git status
``
- Expected:.env,test.log, andnode_modules/should not appear ingit status`.

Task 2: Set Up a Global Exclude File

Goal: Ignore .DS_Store and .vscode/ across all repos so you never have to add them manually.

1. Create the global exclude file:
   bash
touch ~/.gitignore_global
2. Edit it:
   bash
nano ~/.gitignore_global
3. Add these rules:
   ```gitignore
   # OS metadata
   .DS_Store
   Thumbs.db

# IDE/Editor files
.vscode/
.idea/

# Local overrides
.env.local
4. Tell Git to use this file:bash
git config --global core.excludesfile ~/.gitignore_global
5. Verify it works:bash
cd ~/projects/another-repo
touch .DS_Store
git status
``
- Expected:.DS_Storeshould not appear ingit status`.

Task 3: Debug Why a File Isn’t Ignored

Goal: Figure out why debug.log is still showing up in git status.

1. Check if Git is ignoring the file:
   bash
git check-ignore -v debug.log
2. Output Example:
   .gitignore:3:*.log debug.log
   → This means .gitignore line 3 (*.log) is ignoring debug.log.

3. If no output: Git isn’t ignoring the file. Check for typos in .gitignore.

4. If the file was already tracked before adding it to .gitignore:
   bash
git rm --cached debug.log
git commit -m "Stop tracking debug.log"

5. Now Git will ignore it.

Task 4: Remove a Secret from Git History

Goal: You accidentally committed .env and pushed it. Fix it before it’s too late.

1. Remove the file from Git’s index (but keep it on disk):
   bash
git rm --cached .env
2. Add .env to `.gitignore:
   bash
echo ".env" >> .gitignore
3. Commit the changes:
   bash
git add .gitignore
git commit -m "Ignore .env"
4. If you already pushed the secret:
5. Use git filter-repo (recommended) or git filter-branch to rewrite history.
6. Rotate all exposed secrets immediately.
7. Warn your team to rebase their branches.

```bash
# Install git-filter-repo (if not installed)
pip install git-filter-repo

# Remove .env from history
git filter-repo --invert-paths --path .env
git push origin --force --all
```

4. ? Production-Ready Best Practices

Security

• Never commit:
• .env, *.pem, *.key, id_rsa, credentials.json, *.sqlite3.
• Use git-secrets (AWS Labs) to block secrets before they’re committed.
  bash
git secrets --install
git secrets --add 'aws_access_key_id|aws_secret_access_key'
• Rotate secrets immediately if they’re exposed, even if you "fixed" Git history.

Cleanliness & Performance

• Ignore build artifacts:
• node_modules/, dist/, build/, *.pyc, *.class, *.jar.
• Ignore IDE/Editor files:
• .vscode/, .idea/, *.swp, *.sublime-workspace.
• Ignore OS metadata:
• .DS_Store, Thumbs.db, desktop.ini.
• Ignore logs & temp files:
• *.log, *.tmp, *.bak, npm-debug.log.

Consistency

• Use a .gitignore template for your tech stack (e.g., gitignore.io).
• Enforce .gitignore in CI/CD:
• Add a step to fail the build if ignored files are accidentally committed.
• Example (GitHub Actions):
  ```yaml
  • name: Check for ignored files run: |
    if git check-ignore -v $(git ls-files --others --exclude-standard); then
    echo "Error: Ignored files are being tracked!"
    exit 1
    fi ```

Team Workflow

• Commit .gitignore to the repo so everyone ignores the same files.
• Use git check-ignore in PR reviews to catch mistakes early.
• Document ignore rules in CONTRIBUTING.md (e.g., "We ignore .env—use .env.example instead").

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus

Typical Question Patterns

1. "Which file should you use to ignore .DS_Store across all repos?"
2. ✅ Answer: ~/.gitignore_global (global exclude file).

3. ❌ Trap: .git/info/exclude (local-only, not shared).

4. "How do you stop tracking a file that’s already committed?"

5. ✅ Answer: git rm --cached file.txt.

6. ❌ Trap: rm file.txt (deletes the file from disk).

7. "What does /temp/ match?"

8. ✅ Answer: temp/ in any subdirectory (e.g., src/temp/, tests/temp/).

9. ❌ Trap: Only temp/ in the root.

10. "You want to ignore all .log files except error.log. How?"

11. ✅ Answer:
    gitignore
*.log
!error.log

12. ❌ Trap: Putting !error.log before *.log (order matters).

13. "How do you debug why debug.log isn’t ignored?"

14. ✅ Answer: git check-ignore -v debug.log.
15. ❌ Trap: git status (doesn’t explain why).

7. ? Hands-On Challenge

Challenge

You have a Python project with: - A secrets.json file (accidentally committed).
- A venv/ directory (not ignored).
- A debug.log file (should be ignored).

Tasks:
1. Stop tracking secrets.json without deleting it.
2. Ignore venv/ and *.log in .gitignore.
3. Verify debug.log is ignored.

Solution

# 1. Stop tracking secrets.json
git rm --cached secrets.json

# 2. Add rules to .gitignore
echo "venv/" >> .gitignore
echo "*.log" >> .gitignore

# 3. Verify debug.log is ignored
git check-ignore -v debug.log  # Should show the .gitignore rule
git status  # Should not show debug.log or venv/

Why it works:
- git rm --cached removes the file from Git’s index but keeps it on disk.
- .gitignore rules apply immediately to untracked files.
- git check-ignore confirms the ignore rule is working.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

1. Official Git Docs – gitignore
2. gitignore.io – Generate .gitignore templates
3. GitHub’s .gitignore templates
4. git-secrets – Prevent committing secrets
5. git-filter-repo – Safely rewrite Git history