Keeping Git Repos Clean

Two classes of files keep ending up in repos: secrets and dev artifacts. Both are cheap to prevent and expensive to clean up after the fact, because git history is forever and public repos publish everything.

The one rule everyone forgets

.gitignore does NOT untrack files that are already committed. Adding a path to .gitignore only prevents future untracked files from being staged. A file git is already tracking keeps getting committed regardless. This bites repeatedly: a .env is listed in .gitignore but was committed before the rule existed, so it keeps shipping.

To actually stop tracking a file while keeping your local copy: