Keeping Git Repos Clean

Two classes of files keep ending up in repos: secrets and dev artifacts. Both are cheap to prevent and expensive to clean up after the fact, because git history is forever and public repos publish everything.

The one rule everyone forgets

.gitignore does NOT untrack files that are already committed. Adding a path to .gitignore only prevents future untracked files from being staged. A file git is already tracking keeps getting committed regardless. This bites repeatedly: a .env is listed in .gitignore but was committed before the rule existed, so it keeps shipping.

To actually stop tracking a file while keeping your local copy:

git rm --cached path/to/file        # untrack, leave working-tree copy in place
git rm -r --cached some/dir/        # for a directory
echo "path/to/file" >> .gitignore   # then ignore it so it doesn't come back
git commit -m "Stop tracking <file>; add to .gitignore"

--cached is the important flag, plain git rm deletes the working copy too.

Audit what a repo actually tracks

Don't trust .gitignore to tell you what's clean, read the index directly:

git ls-files | grep -iE '\.(env|pem|key|p12|profraw|log|bak|db|sqlite3?)$'
git ls-files | grep -iE '(^|/)(\.DS_Store|~\$|todo\.db|node_modules/|__pycache__/)'
git ls-files '*.db' '*.sqlite*'                 # scratch databases
git ls-files | xargs -I{} du -h {} | sort -rh | head   # surprisingly large tracked files

Usual suspects seen across real repos: