Seed a comprehensive .gitignore on aipm init and stop refresh-managing it - #20
Merged
Merged
Conversation
A fresh `aipm init` previously wrote only a 4-line `.gitignore`, so a brand-new scaffold could easily commit secrets. The seeded `.gitignore` is now comprehensive — it ignores `.env*`, `*.log`, `coverage`, common caches, and `scratch/`, while retaining `node_modules/`, `*.tsbuildinfo`, `*.local.*`, and `.DS_Store`. Build output (`dist/`) is deliberately still tracked, per the build/freshness contract. `.gitignore` is also removed from the `aipm init --refresh` managed set and is now seed-only: `init` writes it, the user owns it thereafter. Because users legitimately extend `.gitignore`, keeping it managed caused every refresh to report it as a perpetual conflict (and `--force` would clobber the additions). The `.aipm/scaffold.json` sidecar now tracks only `.github/workflows/ci.yml`. Resolves #19.
There was a problem hiding this comment.
Pull request overview
This PR adjusts aipm init / aipm init --refresh scaffold ownership so .gitignore is seeded once (with a safer, more comprehensive baseline) and is no longer refresh-managed, preventing perpetual refresh conflicts and reducing the risk of accidentally committing secrets in newly scaffolded repos.
Changes:
- Expanded the seeded
.gitignoreto cover.env*, logs, coverage, caches, andscratch/(while intentionally not ignoringdist/). - Removed
.gitignorefrom the refresh-managed scaffold set so refresh only manages.github/workflows/ci.ymland the sidecar tracks only that file. - Updated specs, tests, and added a changeset to reflect the new ownership boundary and behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| packages/core/src/pipeline/init-template.ts | Makes .gitignore a comprehensive seed-only file and removes it from buildManagedScaffoldFiles() so refresh manages only CI. |
| packages/core/src/pipeline/init.test.ts | Updates sidecar expectations (only ci.yml) and adds a .gitignore seed safety test (.env* ignored; dist/ not ignored). |
| packages/core/src/pipeline/scaffold-refresh.test.ts | Re-targets refresh behavior tests to ci.yml and asserts .gitignore is never reported/touched by refresh (even with --force). |
| docs/specs/scaffold-refresh-and-upgrade.md | Updates file-ownership table and narrative to mark .gitignore as seed-only / user-owned. |
| .changeset/gitignore-seed-only.md | Records the behavioral change and releases a minor bump for @ai-plugin-marketplace/core. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address PR review: the `.gitignore` doc comment cited `.gitattributes` as the source of the committed-`dist/` contract, but `.gitattributes` only marks docs/api-report as linguist-generated and `aipm init` seeds no `.gitattributes` into consumer repos. Point at the actual spec instead — architecture.md §P5 (committed generated outputs) and §10.5 (freshness check).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #19.
Problem
Two related
.gitignoredefects, surfaced while adoptingaipm init --refreshin thetemplaterepo:aipm initwrote only a 4-line.gitignore(node_modules/,.DS_Store,*.local.*,*.tsbuildinfo). It did not ignore.env*, logs, coverage, caches, orscratch/— so a brand-new scaffold could easily commit secrets. A safety bug, not polish..gitignorewas in the refresh-managed set, guarded by the.aipm/scaffold.jsoncontent-hash sidecar. Since users legitimately extend.gitignore, any addition diverged it from the lean canonical render, so everyaipm init --refreshflagged it as aconflictforever (and--forcewould clobber the user's additions).Fix
The issue's recommended seed-only approach:
renderGitignore()— now ignores.env*,*.log,coverage, common caches, andscratch/, while retainingnode_modules/,*.tsbuildinfo,*.local.*, and.DS_Store. Deliberately does not ignoredist/(toolkit build output is committed for the install/freshness contract)..gitignorefrom the refresh-managed set (buildManagedScaffoldFiles()) — it's now seeded directly bybuildInitFiles()and owned by the user thereafter.aipm init --refreshonly manages.github/workflows/ci.yml; the sidecar tracks onlyci.yml. User.gitignoreadditions are never clobbered or perpetually flagged.Changes
packages/core/src/pipeline/init-template.ts— comprehensive seed;.gitignoremoved from managed set to seed-only.docs/specs/scaffold-refresh-and-upgrade.md— file-ownership table (.gitignore→ No) + prose.packages/core/src/pipeline/init.test.ts— sidecar now expects onlyci.yml; new test asserting the seeded.gitignorecontains.env*(and other patterns) and does not ignoredist/.packages/core/src/pipeline/scaffold-refresh.test.ts— re-pointed managed-file behavior tests from.gitignoretoci.yml; new test asserting.gitignoreis never in refresh outcomes and user edits survive (with and without--force)..changeset/gitignore-seed-only.md— minor bump to@ai-plugin-marketplace/core.Acceptance
aipm initignores.env*out of the box (test added).aipm init --refreshno longer reports.gitignore; sidecar tracks onlyci.yml(tests updated).templaterepo's.gitignorestops showing as a refresh conflict (Sync scaffold to cli@0.2.0/core@0.3.0 viaaipm init --refreshtemplate#10).Verification
init.test.ts,scaffold-refresh.test.ts.targets/kiro/bundle.test.tsandtargets/gemini/bundle.test.ts(plugin bundle README/LICENSE/steering paths) exist onmainand are out of scope here.References
aipm init --refresh— Addaipm init --refresh(scaffold sync / repo upgrade) + fix init version pinning #17docs/specs/scaffold-refresh-and-upgrade.mdaipm init --refreshtemplate#10