Rails .gitignore template

The credentials rules are the ones to understand, because they encode a deliberate split. config/master.key and config/credentials/*.key are the decryption keys and are ignored. config/credentials.yml.enc appears in the template too, and this is where projects differ: the framework's own design intends the encrypted file to be committed, since it is useless without the key. Ignoring both halves means new developers have no way to get the credentials at all.

config/initializers/secret_token.rb is the older mechanism the credentials system replaced. It held the session signing secret in plain Ruby, and a leaked one lets an attacker forge session cookies. Keeping the rule costs nothing and protects an older application that has not migrated.

The anchored rules cover runtime directories: /log, /tmp and /storage. Logs are append only and machine specific. The tmp directory holds caches, process ids and sockets. /storage is where the file attachment system puts uploaded files in development, so it holds user content rather than project content.

The database rules cover /db/*.sqlite3 and its journal and numbered variants, which is the development database. /public/system, /public/packs and /public/packs-test are asset output directories from the older attachment and bundling systems, produced by a build step from tracked sources. All three are anchored to the root, so an engine mounted inside the application keeps its own equivalents and needs its own rules.

The test rules cover capybara-*.html and pickle-email-*.html, which are page and email snapshots written when an integration test fails, plus /spec/tmp, rerun.txt and /coverage. .byebug_history is the debugger's command history, which records every expression evaluated at a breakpoint including anything you printed to check a value.