# ---------------------------------------------------------------------------
# CHAINBREAK .gitignore
# Security note: several entries here are load-bearing, not cosmetic.
# Terraform state and evidence bundles can contain environment-identifying data.
# ---------------------------------------------------------------------------

# Python
__pycache__/
*.py[cod]
.venv/
.venv-*/
venv/
*.egg-info/
dist/
build/
.pytest_cache/
.mypy_cache/
.ruff_cache/
.import_linter_cache/
.coverage
htmlcov/

# --- Terraform: NEVER commit state. State contains resource identifiers and
# --- may contain sensitive attributes. See THREAT_MODEL.md T-04.
**/.terraform/
# Provider dependency locks are reviewed and committed. Terraform state,
# plans, tfvars and outputs remain ignored below.
*.tfstate
*.tfstate.*
*.tfplan
**/tfplan
**/.build/
*.tfvars
!*.tfvars.example
# chainbreak infra apply's captured `terraform output -json` -- real
# account/ARN data (T-13), read by providers.aws.preflight at runtime.
infra/terraform/environments/*/outputs.json
crash.log
crash.*.log
override.tf
override.tf.json
*_override.tf
*_override.tf.json

# --- Evidence and run artifacts: local by default. Publishing a bundle is an
# --- explicit, reviewed action (see REPRODUCIBILITY.md).
# Anchored to the repo root (leading /): unanchored "evidence/" previously also
# matched src/chainbreak/evidence/, the source package, and silently dropped it
# from every commit. Caught only when CI's import-linter reported the package
# missing on a real clone -- see PROJECT_STATUS.md known issues.
/runs/
/evidence/
*.jsonl
*.parquet
chainbreak.sqlite
chainbreak.sqlite-*
/reports/
# Same class of bug as the /evidence/ anchoring above (M0), found again at M6:
# the blanket *.jsonl rule also silently dropped the committed golden/tampered/
# malicious bundle fixtures test_sealing.py and test_bundle_ingest_safety.py
# depend on. Fixtures are synthetic and safe to publish; only runtime output
# under /runs/ needs to stay local.
!tests/fixtures/bundles/**/*.jsonl

# --- Credentials and local config: must never reach the repository.
.env
.env.*
!.env.example
*.pem
*.key
credentials
aws_credentials
.aws/
# chainbreak.toml names a real account id in allowed_account_ids (SI-6) and is
# generated by scripts/bootstrap_aws_config.py. Only the example is tracked.
chainbreak.toml
chainbreak.local.toml
!chainbreak.example.toml

# OS / editor
.DS_Store
Thumbs.db
.idea/
.vscode/
!.vscode/extensions.json

# Claude Code local settings/permissions
.claude/settings.local.json
