_out
_repos
.git
.idea
.vscode

# Go binaries built straight into the repository root.
#
# `go build ./cmd/<name>` (without -o) drops the executable in the working
# directory under the package name, so every package under cmd/ has a
# root-level binary waiting to happen — each ~80 MB, and nothing else here
# matched them, leaving `git add .` one keystroke from committing one.
/api-gate
/backport-audit
/backup-controller
/backupstrategy-controller
/check-readiness
/cozypkg
/cozystack-api
/cozystack-controller
/cozystack-operator
/flux-plunger
/flux-shard-operator
/kubeovn-plunger
/lineage-controller-webhook
/observability-proxy
/securitygroup-controller

# User-specific stuff
.idea/**/workspace.xml
.idea/**/tasks.xml
.idea/**/usage.statistics.xml
.idea/**/dictionaries
.idea/**/shelf

# AWS User-specific
.idea/**/aws.xml

# Generated files
.idea/**/contentModel.xml

# Sensitive or high-churn files
.idea/**/dataSources/
.idea/**/dataSources.ids
.idea/**/dataSources.local.xml
.idea/**/sqlDataSources.xml
.idea/**/dynamic.xml
.idea/**/uiDesigner.xml
.idea/**/dbnavigator.xml

# Gradle
.idea/**/gradle.xml
.idea/**/libraries

# Gradle and Maven with auto-import
# When using Gradle or Maven with auto-import, you should exclude module files,
# since they will be recreated, and may cause churn.  Uncomment if using
# auto-import.
# .idea/artifacts
# .idea/compiler.xml
# .idea/jarRepositories.xml
# .idea/modules.xml
# .idea/*.iml
# .idea/modules
# *.iml
# *.ipr

# CMake
cmake-build-*/

# Mongo Explorer plugin
.idea/**/mongoSettings.xml

# File-based project format
*.iws

# IntelliJ
out/

# mpeltonen/sbt-idea plugin
.idea_modules/

# JIRA plugin
atlassian-ide-plugin.xml

# Cursive Clojure plugin
.idea/replstate.xml

# Crashlytics plugin (for Android Studio and IntelliJ)
com_crashlytics_export_strings.xml
crashlytics.properties
crashlytics-build.properties
fabric.properties

# Editor-based Rest Client
.idea/httpRequests

# Android studio 3.1+ serialized cache file
.idea/caches/build_file_checksums.ser

.DS_Store
**/.DS_Store

tmp/

# build revision marker (generated by make image-packages)
packages/core/platform/.build-revision

# Agent tooling. The md-no-hardwrap hook and its registration are shared with
# every contributor, so they are tracked by name; personal agent state (local
# settings overrides, worktrees, session data) stays out of git. Put personal
# overrides in .claude/settings.local.json -- .claude/settings.json is tracked
# and git will overwrite it on pull.
.claude/*
!.claude/hooks/
.claude/hooks/*
!.claude/hooks/md-no-hardwrap.py
!.claude/settings.json

# Credentials and runtime state minted by the backup/restore demo scripts
# under examples/backups/*/. Files are written by 00-helpers.sh +
# 02-create-bucket.sh + 04-create-backupjob.sh; cleanup.sh deletes them
# on teardown. Keep them out of git so a tenant who runs the demo and
# then `git add .` does not accidentally commit S3 keys.
examples/backups/*/.bucket-info.env
examples/backups/*/.sentinel.env
examples/backups/*/.backup-name.env
examples/backups/*/.source-dump.txt
packages/core/platform/images/migrations/etcd-operator-crds/

# CI scratch: promote-rc.yaml checks the dispatch ref here so release tooling
# (validator, agent instructions) is current even when the checked-out rc tag
# predates it. Never committed.
.release-tooling

# Machine credentials and boot artifacts hack/e2e-prepare-cluster.bats writes
# to the repository root when the e2e sandbox is brought up outside CI: the
# Talos secrets bundle and rendered machine configs, the kubeconfigs, the boot
# image and the per-VM directories. secrets.yaml holds the cluster's private
# keys, and before this block nothing here matched any of them -- leaving
# `git add -A` in a tree that once ran the bringup one keystroke from
# committing a credentials bundle.
/secrets.yaml
/talosconfig
/kubeconfig
/tenantkubeconfig*
/controlplane.yaml
/worker.yaml
/patch.yaml
/patch-controlplane.yaml
/nocloud-amd64.raw
/nocloud-amd64.raw.xz
/srv1/
/srv2/
/srv3/