.gitignore

# =============================================================================
# OS
# =============================================================================
.DS_Store
Thumbs.db

# =============================================================================
# Go
# =============================================================================
# Workspace
go.work
go.work.sum

# Test binaries and output
*.test
tmp/
test_outputs/
temp-*.md

# Coverage
*.out
*.cover
cover/
coverage.txt

# Binaries
bin/
/aicr
/aicrd
# Stray binaries from `go build ./tools/<name>` at the repo root (the Makefile
# uses `go run`, so these are only ever accidental).
/bom
/testgrid-publish
/health
/registry-inventory
# ...and a compiled binary landing inside the tool package dir (its name equals
# the dir, so `go build` there emits it right next to the source).
tools/registry-inventory/registry-inventory

# install
/aicr_*.tar.gz
/aicr-attestation.sigstore.json
/recipe-catalog.sigstore.json

# Generated aicrd binary attestations copied into ko data at release time
cmd/aicrd/kodata/*.sigstore.json

# =============================================================================
# Build & Release
# =============================================================================
dist/

# Generated by 'make notices' / 'make release'
.licenses-cache/

# Ko
.digest

# Cosign / Signing
cosign.*
*.pem

# SBOM
sbom.json

# =============================================================================
# Project Output
# =============================================================================
# Generated recipe/bundle output
/recipe.yaml
/bundle/
/bundles/
/bundles.zip

# Test reports
report.xml
coverage.xml

# Image digests
digests.txt
images.json

# Demos
demos/images/*local.png
demos/*local.md
bundle.zip
image-oci
/aicr-config.yaml
/snapshot.yaml
/dry-run.json
/evidence
/report.json
/evidence-result.json
/rekor.pub
/ctfe.pub
/trusted_root.json
/fulcio-chain.pem

# =============================================================================
# Terraform
# =============================================================================
.terraform/
.terraform.lock.hcl
*.tfstate
*.tfstate.*
*.tfvars
*.tfvars.json
crash.log
crash.*.log
override.tf
override.tf.json
*_override.tf
*_override.tf.json
.terraformrc
terraform.rc

# =============================================================================
# Helm
# =============================================================================
**/charts/*.tgz

# =============================================================================
# Credentials & Secrets
# =============================================================================
.env
.envrc.local
gha-creds-*.json

# =============================================================================
# IDEs
# =============================================================================
# VS Code
.vscode/
!.vscode/settings.json
!.vscode/launch.json
!.vscode/extensions.json

# JetBrains (GoLand, IntelliJ)
.idea/

# Vim
*.swp
*.swo
*~
Session.vim
.netrwhist
tags

# Emacs
\#*\#
.\#*

# Claude
.claude/settings.local.json
.claude/worktrees/
docs/plans
docs/superpowers/
.worktrees/

# Per-clone local agent overlay (see AGENTS.md "Local Overlay" section)
/AGENTS.local.md

# Per-clone Claude Code personal overlay (auto-loaded alongside .claude/CLAUDE.md)
/CLAUDE.local.md

# Validator generator scaffolding output
pkg/validator/checks/**/*_README.md
pkg/validator/checks/**/*_recipe.yaml

# KWOK
kwok/logs/
aicr-e2e.xml

# Demos
*.mp4
*.mov

# Stray binary from a manual `go build ./tests/.../tlsproxy/` (without -o) run at
# the repo root. The private-Sigstore e2e's run.sh builds the proxy to $TMPDIR,
# so this only guards an accidental local build; the source stays tracked.
/tlsproxy

# Resolved MDX toolchain for tools/check-docs-mdx-parse. The manifest and
# lockfile in tools/mdx/ ARE committed; only the installed tree is not.
tools/mdx/node_modules/