Dockerfiles in a hidden folder or with a hidden name are not scanned #413

Version

Update-time 0.0.44

Summary

Update-time skips every path that has a part starting with a dot, unless the file type's pattern names that part. So it skips a Dockerfile in a hidden folder, such as .devcontainer/Dockerfile, and a hidden Dockerfile, such as .gitpod.dockerfile. Both are common places for a Dockerfile. Their base images are never updated, pinned, or checked for staleness.

The README and the --exclude-path help do not describe this rule correctly either. The help says Update-time ignores hidden folders. The code skips hidden files as well.

Steps to reproduce

TheAlgorithms/Java has two Dockerfiles:

• .devcontainer/Dockerfile, which its devcontainer.json builds through "build": {"dockerfile": "Dockerfile"}.
• .gitpod.dockerfile, which its .gitpod.yml builds through image: {file: .gitpod.dockerfile}.

Run update-time --log-level DEBUG in a clone of that repository.

Expected

Update-time checks both Dockerfiles. .gitpod.dockerfile opens with FROM gitpod/workspace-java-21:2025-11-14-10-05-32, which Update-time pins to its digest.

Actual

The log does not show a Checking if there are updates for line for either file, and neither file changes. Update-time does check .devcontainer/devcontainer.json, in the same hidden folder as the skipped Dockerfile.

Copied to a scratch repository as a plain Dockerfile, the gitpod file is pinned:

INFO Pinned gitpod/workspace-java-21 in Dockerfile:1 to 2025-11-14-10-05-32@sha256:951dea34af1c9fc1906f57577e203ffb185b5c6231e4f3f9be071197c0849158

Analysis

In io/filesystem.py, glob_for drops a path when any of its parts starts with a dot. It keeps that path only when the pattern itself names the hidden part. The devcontainer patterns name .devcontainer, so devcontainer.json is found there. The Dockerfile patterns, Dockerfile, *.Dockerfile, and Dockerfile.*, name no hidden part. A probe of the patterns over the clone gives:

Options

1. Add the hidden locations to the Dockerfile patterns: .devcontainer/Dockerfile, .devcontainer/*/Dockerfile, and .gitpod.dockerfile. This follows how the devcontainer configs are found. It covers the conventional names, and only those.
2. Follow the references that name a Dockerfile: build.dockerfile in a devcontainer.json, and image.file in a .gitpod.yml. This finds every Dockerfile those tools build, whatever its name. It needs a parse of another file before the walk.
3. Stop skipping hidden files, and keep skipping hidden folders. This finds .gitpod.dockerfile but not .devcontainer/Dockerfile. It also reaches every other hidden file a broad pattern matches, such as a .*.yml under .circleci/.

Documentation

The --exclude-path help and the README name the hidden folders Update-time skips. Whatever the option, they should name hidden files as well, or the exceptions this issue adds. The Docker images file table in the README gets the new locations. The fix gets a changelog entry.