# Keeping GIT Repos Clean

Prevents, detects, and remediates files that should never be committed, secrets (.env...

- Repository: https://github.com/kajisho5/ffmpeg-skill (4279 stars)
- Category: Git and review
- License: MIT
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kajisho5/ffmpeg-skill --skill keeping-git-repos-clean -g -a claude-code -y`
Codex: `npx skills add kajisho5/ffmpeg-skill --skill keeping-git-repos-clean -g -a codex -y`
Cursor: `npx skills add kajisho5/ffmpeg-skill --skill keeping-git-repos-clean -g -a cursor -y`
Gemini CLI: `npx skills add kajisho5/ffmpeg-skill --skill keeping-git-repos-clean -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add kajisho5/ffmpeg-skill`

## Description

Prevents, detects, and remediates files that should never be committed, secrets (.env, API tokens, hardcoded credentials) and dev artifacts (build output, scratch databases, editor/OS files). Covers .gitignore (and why it does not untrack), git rm --cached, auditing tracked files, history scrubbing, and credential rotation. Use when a repo has committed secrets or junk, when setting up a new repo's ignore rules, or when reviewing what a repo actually tracks.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Keeping Git Repos Clean

Two classes of files keep ending up in repos: **secrets** and **dev artifacts**.
Both are cheap to prevent and expensive to clean up after the fact, because git
history is forever and public repos publish everything.

## The one rule everyone forgets

**`.gitignore` does NOT untrack files that are already committed.** Adding a path
to `.gitignore` only prevents *future untracked* files from being staged. A file
git is already tracking keeps getting committed regardless. This bites repeatedly:
a `.env` is listed in `.gitignore` but was committed before the rule existed, so
it keeps shipping.

To actually stop tracking a file while keeping your local copy:

```bash
git rm --cached path/to/file        # untrack, leave working-tree copy in place
git rm -r --cached some/dir/        # for a directory
echo "path/to/file" >> .gitignore   # then ignore it so it doesn't come back
git commit -m "Stop tracking <file>; add to .gitignore"
```

`--cached` is the important flag, plain `git rm` deletes the working copy too.

## Audit what a repo actually tracks

Don't trust `.gitignore` to tell you what's clean, read the index directly:

```bash
git ls-files | grep -iE '\.(env|pem|key|p12|profraw|log|bak|db|sqlite3?)$'
git ls-files | grep -iE '(^|/)(\.DS_Store|~\$|todo\.db|node_modules/|__pycache__/)'
git ls-files '*.db' '*.sqlite*'                 # scratch databases
git ls-files | xargs -I{} du -h {} | sort -rh | head   # surprisingly large tracked files
```

Usual suspects seen across real repos:

The rest: https://github.com/kajisho5/ffmpeg-skill/blob/HEAD/.claude/skills/git-hygiene/SKILL.md