[#2703] Turned '.dockerignore', '.gitignore' and '.gitignore.artifact' into deny lists.

[AlexSkrypnyk]

Closes #2703

Summary

Flipped .dockerignore, .gitignore and .gitignore.artifact from allow lists (ignore everything, then un-ignore a curated whitelist) to deny lists that exclude only what is harmful: VCS internals, secrets and local overrides, Composer/Yarn-generated content, database dumps, caches, and content/test artifacts. The allow-list style made every newly added legitimate file silently vanish from git, the container image, or the deployment artifact until it was explicitly whitelisted; the deny-list default inverts that so new files are visible and included unless a rule says otherwise. All three files share the same section order and the same pattern conventions, expressed per each engine's matching semantics, and consumer sites receive them completely fence-free. The deployed artifact tree was verified against the pre-change deployment/1.40.1 artifact with no regressions (see the comparison report on the issue).

Changes

.gitignore

• The web/* allow-list block is replaced with explicit denies for Composer-generated directories (web/core, web/libraries, web/*/contrib, drush/Commands/contrib - the latter fixing a previously unignored Composer path), scaffold-written files, local settings overrides, and content/test artifacts.
• Drupal scaffold README.txt placeholders stay scaffolded and are now ignored explicitly: they materialize otherwise-empty web/modules|profiles|themes directories that the Drupal core test bootstrap iterates, so disabling them in composer.json file-mapping breaks ahoy test inside containers where only the image content exists.
• Two deliberate allow-list islands remain: recipes/* (Composer installs contrib recipes of type drupal-recipe into recipes/ next to custom recipes, so they cannot be separated by deny rules) and .claude/* (preserves the existing semantics where only .claude/settings.json is tracked).
• settings.migration.php is tracked by default now, so the MIGRATION fence disappears from this file; the installer still removes the file itself for non-migration installs.

.dockerignore

• The * allow-list is replaced with denies for VCS/IDE/OS files, credentials and local overrides, data/logs/caches, host-installed dependencies, Composer-generated Drupal directories, content/test artifacts, and theme build assets.
• Newly excluded from the build context (previously leaked in through !web): web/sites/*/files user uploads, web/themes/**/node_modules and web/themes/**/build host artifacts, and local settings overrides inside the webroot.
• The in-tree .vortex/tooling dev artifacts are excluded: tests, playground and vendor inside the VORTEX_DEV fence (with README.dist.md), and the tooling caches via the any-depth **/ cache patterns. This shrinks the Vortex development build context from roughly 92 MB to a few MB; consumer sites are unaffected as the fence strips on install.
• The db_cache_* cache-key scratch files that the GitHub Actions workflow writes into the workspace are excluded behind a CI_PROVIDER_GHA fence, keeping them out of the built images.
• All HOSTING_ACQUIA/HOSTING_LAGOON fences and per-tool whitelist lines (!phpstan.neon, !behat.yml, ...) became unnecessary and are gone, which collapses about twenty per-scenario installer fixture diffs into the baseline.

.gitignore.artifact

• The /* allow-list is replaced with denies for VCS/IDE/OS files, non-production scaffold files, local settings overrides, content/test artifacts, development/CI/AI configuration, documentation, testing and linting configuration, dependency manifests and lock files, theme asset sources, caches, and credentials (auth.json, .env.local).
• The deployed set is unchanged: vendor/, built web/ (core, contrib, compiled theme build/ assets), config/, drush/, scripts/, .env, composer.json, and Acquia hooks/ (now deployed by default, without a hosting fence).
• Conditional exclusions sit behind the matching fences: /db_cache_* behind CI_PROVIDER_GHA (the GHA workflow writes these into the workspace for hashFiles() cache keys; the CircleCI config writes them to /tmp), and /.vortex plus /README.dist.md behind VORTEX_DEV (they never exist in consumer sites).
• Two deliberate deltas: recipes/ now deploys (config-class content, enables recipe-based provisioning from the artifact), and web/sites/*/settings.local.php/services.local.yml are newly denied as protective coverage.

Pattern conventions

The three files use one set of conventions, adjusted for the difference between the two matching engines: gitignore patterns without a slash match at any depth and a leading / anchors to the root, while dockerignore patterns are always rooted and need a **/ prefix to match at any depth.

• Shared entries use identical forms everywhere they appear: multisite web/sites/*/settings.local.php, web/sites/*/services.local.yml and web/sites/*/files; web/themes/**/node_modules; web/themes/**/build.
• Cache and data entries (.artifacts, .data, .logs, .phpunit.cache, .twig-cs-fixer.cache) match at any depth in all three files: unanchored in the gitignore-syntax files, **/-prefixed in .dockerignore.
• Root-only entries (/vendor, /node_modules, lock files, local override files) are /-anchored in the gitignore-syntax files and plain in .dockerignore, where every pattern is rooted by definition.
• Deliberate asymmetries: .gitignore carries no VCS/IDE/OS section because OS junk belongs in the developer's global gitignore, while the image and artifact have no global mechanism and deny **/.DS_Store themselves; auth.json is denied only in the artifact because the image build requires it for Composer access to private packages while hosting git must never receive tokens; the artifact's theme source entries stay theme-path-exact because another theme may legitimately serve raw js/ or images/ at runtime.

Tests and fixtures

• MigrationHandlerProcessTest no longer asserts migration content in .gitignore - the deny list carries none in either state.
• SutTrait::injectTestingTooling() now also appends a test-only .tooling-source exclusion to .gitignore.artifact, mirroring its .dockerignore handling, so the injected tooling source never enters the deployment artifact.
• Installer snapshot fixtures regenerated: per-tool and per-hosting .dockerignore/.gitignore diffs collapsed into _baseline, the artifact-carrying scenarios regenerated with the new deny-list content, and the CircleCI scenarios gained .dockerignore diffs from the CI_PROVIDER_GHA fence.

Consumer impact

Consumers who added their own un-ignore entries to these files will hit merge conflicts on the next Vortex update and need to translate them into deny form. The container image now includes previously excluded harmless text files (README.md, docs/, .github/, dockerfiles, lint configs); everything secret-bearing, generated, or heavy remains excluded. New scaffold files introduced by future Drupal core updates become visible untracked files instead of being silently ignored.

Before / After

BEFORE (allow lists)                        AFTER (deny lists)

.gitignore                                  .gitignore
├─ web/*            (ignore webroot)        ├─ deny: generated dirs, scaffold
├─ !web/... x25     (un-ignore list)        │  files, local settings, content,
├─ recipes/* + !recipes/page                │  caches, local overrides
├─ .claude/* + !settings.json               ├─ recipes/* island (composer path)
├─ #;< MIGRATION fence                      ├─ .claude/* island (unchanged)
└─ #;< VORTEX_DEV fence                     └─ #;< VORTEX_DEV fence

.dockerignore                               .dockerignore
├─ *                (ignore all)            ├─ deny: VCS/IDE/OS, secrets,
├─ !web !config !tests !.env ...            │  generated dirs, data/logs/caches,
├─ !phpcs.xml !phpstan.neon ...             │  deps, content, theme builds
├─ #;< HOSTING_ACQUIA  !hooks               ├─ no per-tool lines
└─ #;< HOSTING_LAGOON  !.lagoon.env.*       └─ #;< VORTEX_DEV + CI_PROVIDER_GHA

.gitignore.artifact                         .gitignore.artifact
├─ /*               (ignore all)            ├─ deny: dev/CI/AI config, docs,
├─ !.env !/config/ !/vendor/ !web ...       │  tests, lint configs, lock files,
└─ #;< HOSTING_ACQUIA  !/hooks/             │  credentials, theme sources
                                            └─ #;< VORTEX_DEV + CI_PROVIDER_GHA

new legitimate file → silently missing      new legitimate file → included and
until whitelisted in the right file         visible; deny it only if harmful

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The ignore rules in .dockerignore, .gitignore, and .gitignore.artifact now use explicit deny lists for generated, local, cache, and dependency paths. Tooling tests also now exclude /.tooling-source from the deployment artifact.

Changes

Ignore File Deny-List Rework

Layer / File(s)	Summary
.dockerignore deny-list conversion .dockerignore	Converts .dockerignore to explicit exclusions for VCS, IDE, OS, local override, cache, dependency, generated Drupal, test-content, and theme build paths, and reworks .vortex/tooling exclusions.
.gitignore and artifact deny-list updates .gitignore, .gitignore.artifact	Replaces broad ignore/allow-list patterns with explicit deny lists for generated Drupal files, local overrides, dependency and cache artifacts, and removes the hosting hook block from .gitignore.artifact.
Tooling artifact exclusion .vortex/tests/phpunit/Traits/SutTrait.php, .vortex/installer/tests/Functional/Handlers/MigrationHandlerProcessTest.php	Updates injectTestingTooling() to document and append the /.tooling-source deployment-artifact exclusion, and removes the migration test assertions tied to .gitignore entries for settings.migration.php.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• drevops/vortex#2638: Both PRs update ignore rules and related docs around .artifacts/ and other generated paths.
• drevops/vortex#2531: Both PRs modify .dockerignore ignore/allow patterns for Docker build context.
• drevops/vortex#2757: Both PRs touch .gitignore ignore logic for Drupal scaffolding, including the recipes/page exception.

Suggested labels: A3

Poem

I hopped through ignore rules, line by line,
Deny-lists now keep the build path fine.
A tiny /.tooling-source trail,
And caches, logs, and clutter set sail. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes match #2703 by rewriting .dockerignore, .gitignore, and .gitignore.artifact into deny lists and updating related tests.
Out of Scope Changes check	✅ Passed	The extra test and fixture updates appear directly related to the ignore-rule rewrite and do not show unrelated scope creep.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: converting the three ignore files to deny lists.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/2703-ignore-deny-list

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.gitignore:
- Around line 4-34: The .gitignore rules are missing common database dump
patterns, so files like SQL exports and SQLite backups can still be committed
accidentally. Update the ignore list near the existing local/generated file
entries to also cover database dump extensions such as *.sql, *.sql.gz, and
*.sqlite3, keeping the pattern set consistent with the existing recipes and
webroot ignore rules.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5e20daaf-f700-4318-a00f-cc8228c32597

📥 Commits

Reviewing files that changed from the base of the PR and between 0a9ffdc and b5421ef.

⛔ Files ignored due to path filters (45)

• .vortex/installer/tests/Fixtures/handler_process/_baseline/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/_baseline/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/_baseline/composer.json is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/ai_instructions_disabled/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_acquia/composer.json is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_lagoon/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/composer.json is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/hosting_project_name___lagoon/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_disabled_lagoon/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_enabled/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/provision_database_lagoon/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/starter_drupal_cms_profile/composer.json is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_none/.dockerignore is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/tools_none/.gitignore is excluded by !.vortex/installer/tests/Fixtures/**

📒 Files selected for processing (3)

• .dockerignore
• .gitignore
• composer.json

[github-actions]

📖 Documentation preview for this pull request has been deployed to Netlify:

https://6a4f55945e81d033a58b521f--vortex-docs.netlify.app

This preview is rebuilt on every commit and is not the production documentation site.

[AlexSkrypnyk]

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   98.55% (204/207)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

[github-actions]

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   98.55% (204/207)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)