React .gitignore template

The interesting rules here are the four environment ones: .env.local, .env.development.local, .env.test.local and .env.production.local. The convention they encode is a two tier system. Files without the .local suffix hold shared defaults and are meant to be committed, while the .local variants hold whatever one developer needs to override on their own machine and are not.

That distinction is worth understanding rather than memorising, because it is the reason this template does not ignore .env at all. If you put a real secret in the plain .env expecting the template to protect it, nothing will stop the commit. Anything sensitive belongs in a .local file, or better, outside the repository entirely.

There is a second consideration specific to frontend work. Values that reach the browser bundle are not secret whatever file they came from, because anyone can read them in the shipped JavaScript. The environment rules here are about keeping one developer's local API endpoint out of everyone else's checkout, not about protecting a key that the build inlines anyway.

build and dist are the two output directory names, covering both the classic toolchain and the newer bundlers. Both are produced from tracked sources, both are large, and both change wholesale whenever a dependency version moves, which makes them the worst possible thing to have in a diff.

The rest is small: node_modules, the three debug logs, the coverage directory and .eslintcache. Together they make this a template you almost always combine with something else rather than use on its own. A real project wants a package manager template for the lockfile rules, an operating system template, and whichever editor template matches the team, which is three more selections before the output is complete.