# .git is deliberately NOT ignored: the build stage runs setuptools_scm, which
# derives the version from git metadata, so `uv sync` cannot build the project
# without it (and _version.py is itself gitignored).

# Build and test outputs - regenerated inside the image, and a stale .venv from
# the host would be the wrong architecture.
.venv/
build/
dist/
docs/_build/
.tox/
*.egg-info/
**/__pycache__/
*.py[cod]

# Caches and coverage
.pytest_cache/
.ruff_cache/
.mypy_cache/
.coverage
cov.xml

# NOTHING TRACKED MAY BE EXCLUDED BELOW THIS LINE. The build stage runs
# setuptools_scm against the .git above, and an excluded *tracked* file reads to
# `git describe --dirty` as a deletion: the context is dirty, so a build of the
# tagged commit renders the next version instead of the tag. `.devcontainer/`
# and `.vscode/` (five tracked files, inherited from the copier template) sat
# here and did exactly that - 0.4.0-beta.2 built an image reporting
# 0.4.0b3.dev0+g50cc5414e.d20260821, which is the version `model.image_tag_for`
# would then refuse to ask for. They are gone rather than replaced with a
# workaround: they cost the build stage a few KiB and reach the runtime image
# never, since only /app/.venv crosses over.
#
# Only untracked or gitignored paths belong here. `git describe --dirty` does
# not consider untracked files, so the two entries below are free.

# Generated kubeconfigs, which `k8s/.gitignore` keeps out of the history for the
# same reason. Gitignoring them is not enough here: the build context is the
# working tree, not `git ls-files`, so `COPY . /app` picks them up on any machine
# where they exist. The multi-stage build keeps them out of the shipped image -
# only `/app/.venv` crosses over - but they still land in every build-stage layer
# the daemon caches. Measured 2026-08-21 on the k3s bed: two live DLS
# service-account kubeconfigs, in 30 files across 16 cached layers.
k8s/*.kubeconfig

# Session scratch. Never wanted in an image, and `tmp/` can hold anything.
tmp/
