From 22adfdf9bb65d27aab6ee9d8ab4b489f74e2bc85 Mon Sep 17 00:00:00 2001
From: Josh Luedeman <josh@joshluedeman.com>
Date: Thu, 17 Sep 2026 16:53:03 -0400
Subject: [PATCH] chore: harden .gitignore against secrets and local config

Adds the org-wide baseline blocking kubeconfigs, private keys and
keystores, Terraform state, .env files, cloud CLI credential caches,
vendored dependencies and OS noise.

Coverage gap this closes (measured across all 69 repos):
  kubeconfig   not ignored in 67
  *.key/*.pem  not ignored in 67
  id_rsa       not ignored in 68
  .env         not ignored in 63

.env.example and .env.*.example remain tracked via negation.

Refs POps-Rox/.github#1

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0543f12b-012b-495d-a226-87b651348071
---
 .gitignore | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/.gitignore b/.gitignore
index 2faf43d..ac54b58 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,72 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
+
+# ---------------------------------------------------------------------------
+# Secrets & local configuration — never commit these to a public repository.
+# Added org-wide 2026-09. See POps-Rox/.github#1
+# ---------------------------------------------------------------------------
+
+# Kubernetes / cluster credentials
+kubeconfig
+kubeconfig.*
+*.kubeconfig
+.kube/
+
+# Private keys, certificates & keystores
+*.key
+*.pem
+*.pfx
+*.p12
+*.jks
+*.keystore
+id_rsa
+id_rsa.*
+id_ed25519
+id_ed25519.*
+*.ppk
+
+# Terraform state & local workspace (state frequently embeds secrets)
+*.tfstate
+*.tfstate.*
+*.tfstate.backup
+.terraform/
+.terraform.lock.hcl.local
+crash.log
+crash.*.log
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+.terraformrc
+terraform.rc
+
+# Environment & local app configuration
+.env
+.env.*
+!.env.example
+!.env.*.example
+local.settings.json
+appsettings.Local.json
+secrets.json
+
+# Cloud CLI / credential caches
+.azure/
+.aws/
+.gcloud/
+azurecreds.conf
+
+# Dependencies & build output
+node_modules/
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+Lib/site-packages/
+pyvenv.cfg
+
+# OS / editor noise
+.DS_Store
+Thumbs.db
+*.swp
+*~