Laravel .gitignore template

This template is unusual because it spends most of its rules on secrets rather than build output. .env, .env.backup and .env.production are all covered. That file holds the database credentials, the mail transport password, the application key and every third party API key the project uses, and the framework reads it at boot rather than from the deployment environment, which is why it exists on disk at all.

/storage/*.key is the application key file, and auth.json holds registry credentials for private package repositories. Both are live secrets. The pattern here is worth internalising: any rule matching *.key or a credentials file is not tidying, it is the difference between a private repository and a public incident.

/public/build and /public/hot are asset pipeline output. The build directory holds the bundled JavaScript and stylesheets with their content hashes, produced from sources that are already tracked. The hot file exists only while a development server is running and contains the URL that server is listening on. /public/storage is a symbolic link to the storage directory, created by a console command rather than checked in.

The /.idea, /.vscode and /.fleet rules are anchored editor directories. Including them in a framework template is a pragmatic choice: a large share of projects use one of those editors, and anchoring means only the root level directory is covered, so a package inside the project keeping its own settings is unaffected.

/vendor and /node_modules cover both dependency trees, since a full stack project has one of each. .phpunit.result.cache stores which tests passed last run so the runner can reorder them, and /storage/pail is a log viewer's working directory. The Homestead files describe one developer's local virtual machine.