From 95065e45ca273987af608e4768a0b1e3fe82b114 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 3 Aug 2026 01:59:07 +0200 Subject: [PATCH 1/3] chore(scripts): gitignore built Go binaries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every scripts// is a `main` package, so a build drops an executable named after its directory: `go build ./scripts//` leaves it in the working directory, and `go build ./...` from the root leaves one per package at the root. Neither has an extension, so nothing in the ignore file covered them, and a directory-wide `git add` stages a multi-megabyte Mach-O binary alongside the source without comment. Listed by name rather than by a glob for extensionless files. That glob would also hide a legitimately extensionless file added later, and a silently ignored source file is a worse failure than a binary `git status` still shows — the rule fails in the safer direction at the cost of a line when a package is added. Verified across all twelve paths: with the rule none is visible to git, without it all twelve are, and no tracked file becomes ignored. Fixes #2888. --- .gitignore | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/.gitignore b/.gitignore index 615d057a2..7e9015e43 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,26 @@ megalinter-reports/ # stages everything when it pushes auto-fixes back — which is how an empty .pyc reached main. __pycache__/ *.py[cod] + +# Compiled Go binaries. Every scripts// is a `main` package, so a build drops an +# executable named after its directory — `go build ./scripts//` leaves it in the working +# directory, and `go build ./...` from the root leaves one per package at the root. Neither has +# an extension, so nothing else here covers them, and a directory-wide `git add` stages a ~4 MB +# Mach-O binary alongside the source without comment. +# +# Listed by name rather than by a glob for extensionless files: that glob would also hide a +# legitimately extensionless file someone adds later, and a silently ignored source file is a +# worse failure than a binary that `git status` still shows. Add a line here when a new +# scripts// package appears. +/generate-kubescape-exceptions +/kubescape-backlog-bridge +/validate-concurrency-queue +/validate-dr-signing +/validate-eks-ci-role-policy +/validate-merge-group-heal +/scripts/*/generate-kubescape-exceptions +/scripts/*/kubescape-backlog-bridge +/scripts/*/validate-concurrency-queue +/scripts/*/validate-dr-signing +/scripts/*/validate-eks-ci-role-policy +/scripts/*/validate-merge-group-heal From 7083d3e608ce29e97a5b496f729308081da8d402 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 3 Aug 2026 02:21:06 +0200 Subject: [PATCH 2/3] docs: correct the go build form that writes an ignorable binary `go build ./...` over multiple main packages discards the executables rather than writing one per package at the root, so the comment justified the root block with a command that produces nothing. Name the two forms that actually write output instead: `go build ./scripts//` from the root, and `go build .` from inside the package directory. The ignore entries themselves are unchanged and still correct. --- .gitignore | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7e9015e43..34ef4e00d 100644 --- a/.gitignore +++ b/.gitignore @@ -32,10 +32,12 @@ __pycache__/ *.py[cod] # Compiled Go binaries. Every scripts// is a `main` package, so a build drops an -# executable named after its directory — `go build ./scripts//` leaves it in the working -# directory, and `go build ./...` from the root leaves one per package at the root. Neither has -# an extension, so nothing else here covers them, and a directory-wide `git add` stages a ~4 MB -# Mach-O binary alongside the source without comment. +# executable named after its directory: `go build ./scripts//` from the repository root +# writes it at the root, and `go build .` from inside scripts// writes it there — hence the +# two blocks below. (`go build ./...` builds every package but discards the executables, so it +# leaves nothing to ignore.) Neither form gives the file an extension, so nothing else here covers +# them, and a directory-wide `git add` stages a ~4 MB Mach-O binary alongside the source without +# comment. # # Listed by name rather than by a glob for extensionless files: that glob would also hide a # legitimately extensionless file someone adds later, and a silently ignored source file is a From 54b569625b3d98cc1903e767c5cd0b4aed23df04 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 3 Aug 2026 04:03:49 +0200 Subject: [PATCH 3/3] chore(scripts): ignore Windows, test and source-file Go build outputs go test -c, a source-file build, and any GOOS=windows build write names the package-name rules do not match, so the directory-wide staging hazard remained for .test, main, and every .exe variant. --- .gitignore | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 34ef4e00d..0dc63bae2 100644 --- a/.gitignore +++ b/.gitignore @@ -31,27 +31,39 @@ megalinter-reports/ __pycache__/ *.py[cod] -# Compiled Go binaries. Every scripts// is a `main` package, so a build drops an -# executable named after its directory: `go build ./scripts//` from the repository root -# writes it at the root, and `go build .` from inside scripts// writes it there — hence the -# two blocks below. (`go build ./...` builds every package but discards the executables, so it -# leaves nothing to ignore.) Neither form gives the file an extension, so nothing else here covers -# them, and a directory-wide `git add` stages a ~4 MB Mach-O binary alongside the source without +# Compiled Go binaries. Every scripts// is a `main` package, and a build drops its output in +# one of two places: `go build ./scripts//` from the repository root writes at the root, +# `go build .` from inside scripts// writes there — hence the two blocks below. (`go build +# ./...` builds every package but discards the executables, so it leaves nothing to ignore.) A +# directory-wide `git add` otherwise stages a ~4 MB Mach-O binary alongside the source without # comment. # -# Listed by name rather than by a glob for extensionless files: that glob would also hide a -# legitimately extensionless file someone adds later, and a silently ignored source file is a -# worse failure than a binary that `git status` still shows. Add a line here when a new -# scripts// package appears. +# Four output names reach those two places: +# `go build ./scripts//` — named after the package directory +# main `go build main.go` — named after the first source file +# .test `go test -c` — also retained by -cpuprofile and friends +# *.exe any of the above under GOOS=windows (`go test -c` gives .test.exe) +# +# The extensionless names are listed literally rather than matched by a glob for extensionless +# files: that glob would also hide a legitimately extensionless file someone adds later, and a +# silently ignored source file is a worse failure than a binary that `git status` still shows. +# `.exe` and `.test` are unambiguous compiled-artifact extensions, so those two are globbed. Add a +# line to each block when a new scripts// package appears. /generate-kubescape-exceptions /kubescape-backlog-bridge /validate-concurrency-queue /validate-dr-signing /validate-eks-ci-role-policy /validate-merge-group-heal +/main +/*.exe +/*.test /scripts/*/generate-kubescape-exceptions /scripts/*/kubescape-backlog-bridge /scripts/*/validate-concurrency-queue /scripts/*/validate-dr-signing /scripts/*/validate-eks-ci-role-policy /scripts/*/validate-merge-group-heal +/scripts/*/main +/scripts/*/*.exe +/scripts/*/*.test