# Build-context hygiene. docker/ MUST stay (image configs).
.git
.gitignore
.gitattributes
.github

# Secrets & env (never bake into the image)
.env
.env.*
!.env.example

# Deps / build output (reinstalled or rebuilt in the image)
vendor
node_modules
public/build
public/hot
bootstrap/cache/*.php

# Local runtime state
storage/logs/*
storage/framework/cache/data/*
storage/framework/sessions/*
storage/framework/views/*
database/*.sqlite

# Dev tooling / tests / docs (not needed at runtime). NOTE: docs/ is internal-only (export-ignored
# from the public git tree AND named in promote.sh's refuse-to-publish list) — it MUST also be kept
# out of the built image, or `COPY . .` bakes the private docs (with private host/URL refs) into the
# public GHCR image, which the git-tree leak-guard never inspects. Likewise art/ (README assets only).
tests
phpunit.xml
.phpunit.cache
.editorconfig
handoff.md
kickoff-prompt.md
rules.md
CLAUDE.md
README.md
docs
art

# Dev-only release bridge — must NOT bake into the PUBLIC prod image (it carries the private
# upstream references). Also export-ignored from the public repo. Dev keeps it via the bind-mount;
# only the built (prod/public) image is stripped. The /release route is release_controls-gated
# (false in prod), so these classes are never loaded at runtime here.
app/Livewire/Release
app/Services/ReleaseBridge.php
app/Services/ReleasePlanner.php
app/Services/PipelineStatus.php
app/Services/PromotionService.php
resources/views/livewire/release
lang/de/release.php
lang/en/release.php
docker/release
scripts/promote.sh
scripts/promote.test.sh

# Compose files (not needed inside the image)
docker-compose.yml
docker-compose.prod.yml