Skip to content

Respect git global ignore files (core.excludesFile) in source scanner - #20524

Open
Lukecele wants to merge 7 commits into
tailwindlabs:mainfrom
Lukecele:fix/respect-core-excludesfile
Open

Lukecele wants to merge 7 commits into
tailwindlabs:mainfrom
Lukecele:fix/respect-core-excludesfile

Conversation

@Lukecele

Copy link
Copy Markdown

When scanning for source candidates, Oxide previously disabled git global ignore files via builder.git_global(false).

As noted in #15941, the intention was to prevent .gitignore files in parent directories outside of a git repository from taking effect, while keeping global ignore files configured in git working. However, calling git_global(false) on the walker had the unintended side effect of ignoring core.excludesFile (and $XDG_CONFIG_HOME/git/ignore) entirely.

This change enables builder.git_global(true) so that ignore patterns configured in Git's global configuration are respected during source scanning.

Fixes #20509

Test plan

  • Added unit test respects_git_core_excludes_file in crates/oxide/tests/scanner.rs verifying that files matched by Git's core.excludesFile are skipped.
  • Verified that all existing unit and scanner tests continue to pass.

[ci-all]

In tailwindlabs#15941, the intention was to prevent .gitignore files outside of
a git repository from taking effect while ensuring global ignore files
configured in git (like core.excludesFile) continue to work.

However, builder.git_global(false) was explicitly set in the oxide
scanner walker, which caused git's global ignore configuration
(core.excludesFile / ~/.config/git/ignore) to be completely ignored.

This change enables git_global(true) so that global ignore rules
configured in git are honored as expected during source detection.

Fixes tailwindlabs#20509
@Lukecele
Lukecele requested a review from a team as a code owner September 27, 2026 10:02
@greptile-apps

greptile-apps Bot commented Sep 27, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 4/5

[Medium impact] The change affects which files Tailwind’s source scanner returns.

The PR needs the remaining cross-repository global-ignore behavior fixed before merging.

Reviews (7) · Last reviewed commit: "fix(scanner): resolve global ignore patt..." · Reviewed by Greptile

Comment thread crates/oxide/src/scanner/mod.rs
Comment thread crates/oxide/tests/scanner.rs Outdated
@coderabbitai

coderabbitai Bot commented Sep 27, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

The excludes-file parser now accepts quoted core.excludesFile paths that contain spaces. The scanner now respects Git global ignore files and sets the walker directory to the repository root when detected. Tests cover quoted-path parsing and exclusion of globally ignored files.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: 🔵 Low · up to 14740

Repositories using certain valid Git global-ignore path forms may still scan files that should be excluded; the remaining fixes are localized.

Security architecture risk: 🔵 Low · up to 172a4

The change lets Git ignore settings affect which source files are scanned. Existing source-selection controls remain, and no security vulnerability was established. The remaining uncertainty is whether shared build environments allow untrusted parties to control those settings.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — A party controlling the scanner process's Git configuration or selected excludes file can influence discovery for sources subject to those rules. Exposure is bounded by that configuration authority and existing source selection; tenant-wide or cross-service attackability was not established.

Trust Boundaries and Controls

  • observed — The PR activates an existing configuration-to-filesystem path in scanner discovery rather than adding a new configuration reader. Git settings become effective discovery policy, while the scanner's source-selection checks remain in place.

Resilience and Maintainability Implications

  • observed — With the child marker absent, the test launches only itself in a child process and returns before mutating GIT_CONFIG_GLOBAL. Child termination contains that environment state on success or failure. A pre-existing marker skips isolation and leaves the mutation in the invoking test process; this limitation is test-only.
Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title clearly and concisely describes the main change: respecting Git global ignore files in the source scanner.
Description check Passed The description directly explains the scanner behavior change, the affected Git settings, the issue being fixed, and the added test coverage.
Linked Issues check Passed Issue [#20509] requires source scanning to skip candidates matched by Git core.excludesFile. create_walker now enables builder.git_global(true) and sets the repository root as the walker directo…
Out of Scope Changes check Passed The changes remain within issue [#20509]. The walker setting implements global ignore support. The repository-root setting supports correct Git ignore resolution. The parser update supports valid `cor…
Full details: Linked Issues check

Explanation

Issue [#20509] requires source scanning to skip candidates matched by Git core.excludesFile. create_walker now enables builder.git_global(true) and sets the repository root as the walker directory. The added respects_git_core_excludes_file test configures core.excludesFile and verifies that both matching patterns are excluded while the non-matching candidate remains. The parser test covers quoted paths with spaces.

Full details: Out of Scope Changes check

Explanation

The changes remain within issue [#20509]. The walker setting implements global ignore support. The repository-root setting supports correct Git ignore resolution. The parser update supports valid core.excludesFile paths. The added test provides regression coverage. No unrelated change is shown.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
crates/oxide/tests/scanner.rs (1)

2961-2961: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Synchronize the process-wide GIT_CONFIG_GLOBAL mutation.

GIT_CONFIG_GLOBAL is process-wide, and global Git-ignore handling reads it during Scanner::new. The configured pattern matches only ignored-by-global.html. The inspected concurrent scanner fixtures do not contain that basename, and their Git commands are only git init calls with ignored output. The race therefore does not currently change an asserted result or cause a command failure. It can affect a future scan that contains this basename. Isolate this test in a separate process or protect the mutation with a shared lock.


ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 7f764ba3-4601-4e02-b611-e93f5ae31d2d

📥 Commits

Reviewing files that changed from the base of the PR and between fa81d69 and 4f875f5.

📒 Files selected for processing (2)
  • crates/oxide/src/scanner/mod.rs
  • crates/oxide/tests/scanner.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

@Lukecele Lukecele left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Lukecele

Lukecele commented Oct 2, 2026

Copy link
Copy Markdown
Author

Hi maintainers, following up on this regression-test PR. It enables Git global ignore files during source scanning and adds coverage for core.excludesFile, addressing #20509. Greptile review is passing and the branch is mergeable; happy to adjust the implementation or test if there is any concern.

ymendel added a commit to ymendel/dotfiles that referenced this pull request Oct 12, 2026
The hooks are in git/hooks now, still found through core.hooksPath. That
frees git/template to be an actual init.templateDir again. Sure, the
hooks could've stayed behind, but then they'd be copied over on every
`git init` and be the inert copies `git hooks-clean` removes.

For now, this is only info/exclude with /.claude/ in it. But why,
especially when ~/.gitignore (my core.excludesfile) already has it?

Well, there's a bit of belt-and-suspenders action here, just super
ensuring this doesn't get in unless I really, really want it to. Also,
Tailwind v4 doesn't read the global excludes file, and it _does_ read
.git/info/exclude. So something in some note can end up in the built
CSS, even when it's not used in the app.

Watch tailwindlabs/tailwindcss#20524 to see
if/when that changes.
// Don't respect global gitignore files
builder.git_global(false);
// Respect global gitignore files configured in git (e.g. `core.excludesFile`)
builder.git_global(true);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Global ignores use wrong directory

Global ignore patterns containing / are matched from the process working directory, not the scanned repository. If the CLI scans /projects/app from another directory, a global rule src/ignored.html does not exclude /projects/app/src/ignored.html. The scanner still reads that file and generates CSS from it, even though Git ignores it.

Build the global matcher relative to each repository root rather than the process working directory.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (2)

🟡 Minor · Accept valid core.excludesFile syntax at the parser boundary. · gitignore.rs:705

crates/ignore/src/gitignore.rs:705
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Accept valid core.excludesFile syntax at the parser boundary.

The regex rejects valid Git values such as core.excludesFile = " /foo/bar " and /foo/bar # comment. The parser then falls back to another configuration source or the default path, so the configured global ignore file is not applied during source scanning.

Suggested fix
-            .build(r#"(?im-u)^\s*excludesfile\s*=\s*(?:"(\S(?:[^"\r\n]*\S)?)"|(\S+))\s*$"#)
+            .build(r#"(?im-u)^\s*excludesfile\s*=\s*(?:"([^"\r\n]*)"|(\S+))(?:\s+#.*)?\s*$"#)
🟡 Minor · Apply Git-compatible pathname expansion in expand_tilde. · gitignore.rs:717-723

crates/ignore/src/gitignore.rs:717-723
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Apply Git-compatible pathname expansion in expand_tilde.

expand_tilde replaces every ~ with the current user's home directory. For core.excludesFile = ~other-user/ignore, it selects a path under the current user's home. It also changes literal tildes in paths such as /config/~backup/ignore. The scanner can then miss patterns from the configured global ignore file.

Expand only Git's ~/ and ~user/ forms. Resolve ~user/ using that user's home directory, and preserve all other tildes. Do not use str::replace for pathname expansion.


ℹ️ Review info
⚙️ Run configuration
  • Configuration used: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: fb0000c8-a0fa-41c2-baee-07bb877c68d2
📥 Commits

Reviewing files that changed from the base of the PR and between 5fc381d and 147407c.

📒 Files selected for processing: 2
  • crates/oxide/src/scanner/mod.rs
  • crates/oxide/tests/scanner.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Source detection ignores core.excludesFile, so globally-ignored directories are scanned (reproduction for #19801)

2 participants