Keep a submodule's own .git/config out of the build context (closes #88)

The canonical .dockerignore kept out .git/config and the configs under
.git/modules/, but not the config of a submodule that keeps its own .git
directory, so its credential reached the image. Both git patterns now
carry the **/ prefix.

A submodule whose name has a config segment (config, deploy/config,
config/lib) still loses its whole git directory, and Go's version
stamping fails the build. Closing that needs a wildcard re-include,
which makes BuildKit walk every excluded directory on every build, so
the file records it as a KNOWN GAP with the remedy, git submodule add
--name. REPO_POLICIES.md and both checklists say the same.

Model: opus-5-5

.dockerignore

@@ -18,9 +18,16 @@
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
 # Each submodule keeps a config with the same exposure in its git directory
-# under .git/modules/, nested again for a submodule's own submodules.
-.git/config
-.git/modules/**/config
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
 
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.

TODO.md

@@ -21,6 +21,15 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-04: The canonical `.dockerignore` now also keeps out the git `config`
+  of a submodule that keeps its own `.git` directory, which still reached the
+  image (issue 88): both git patterns now carry the `**/` prefix. A submodule
+  whose name has a `config` segment (`config`, `deploy/config`, `config/lib`)
+  still loses its whole git directory, so Go's version stamping fails the build;
+  the file records this as a `KNOWN GAP:` with the remedy,
+  `git submodule add --name`. Closing it would take a wildcard re-include, which
+  makes BuildKit walk every excluded directory, such as `node_modules`, on every
+  build. `REPO_POLICIES.md` and both checklists say so in the same words.
 - 2026-10-04: The note under the canonical Go `Dockerfile` example in
   `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get`
   under their Debian package names (issue 83). The `golangci/golangci-lint`

prompts/EXISTING_REPO_CHECKLIST.md

@@ -63,10 +63,15 @@ with your task.
       here run anywhere other than the repo root, the anchored entry misses
       `services/api/.claude/`: add anchored entries for those directories.
 - [ ] If the repo embeds a version in a binary: `.dockerignore` lets `.git` into
-      the build context. It keeps out `.git/config` and each submodule's
-      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
-      which `git describe` does not need and which can hold a credential: a
-      password in a remote URL, or the token the CI checkout step stores there.
+      the build context. It keeps out every git `config` at any depth
+      (`**/.git/config`, `**/.git/modules/**/config`): the repository's own,
+      each submodule's under `.git/modules/`, and that of a submodule keeping
+      its own `.git` directory. `git describe` does not need them, and each can
+      hold a credential: a password in a remote URL, or the token the CI
+      checkout step stores there. A submodule whose name has a `config` segment
+      (`config`, `deploy/config`, `config/lib`) loses its whole git directory to
+      `**/.git/modules/**/config`, and Go's version stamping then fails the
+      build: give it a name without that segment (`git submodule add --name`).
       The stage that compiles has `git` (the Debian Go image has it; an alpine
       one needs `apk add --no-cache git`) and takes the version from the
       `VERSION` build argument when one is given, otherwise from

prompts/NEW_REPO_CHECKLIST.md

@@ -71,10 +71,15 @@ Template files can be fetched from:
       will run them in subdirectories, `services/api/.claude/` needs its own
       anchored entry.
     - If the image embeds a version in a binary: `.dockerignore` lets `.git`
-      into the build context. It keeps out `.git/config` and each submodule's
-      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
-      which `git describe` does not need and which can hold a credential: a
-      password in a remote URL, or the token the CI checkout step stores there.
+      into the build context. It keeps out every git `config` at any depth
+      (`**/.git/config`, `**/.git/modules/**/config`): the repository's own,
+      each submodule's under `.git/modules/`, and that of a submodule keeping
+      its own `.git` directory. `git describe` does not need them, and each can
+      hold a credential: a password in a remote URL, or the token the CI
+      checkout step stores there. A submodule whose name has a `config` segment
+      (`config`, `deploy/config`, `config/lib`) loses its whole git directory to
+      `**/.git/modules/**/config`, and Go's version stamping then fails the
+      build: give it a name without that segment (`git submodule add --name`).
       The stage that compiles has `git` (the Debian Go image has it; an alpine
       one needs `apk add --no-cache git`) and takes the version from the
       `VERSION` build argument when one is given, otherwise from

prompts/REPO_POLICIES.md

@@ -248,11 +248,16 @@ style conventions are in separate documents:
             && rm -rf /var/lib/apt/lists/*
         ```
 
-    - `.dockerignore` lets `.git` into the build context. It keeps out
-      `.git/config` and each submodule's `config` under `.git/modules/` at any
-      depth (`.git/modules/**/config`), which `git describe` does not need and
-      which can hold a credential: a password in a remote URL, or the token the
-      CI checkout step stores there. The stage that compiles has `git` (the
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
+      repository's own, each submodule's under `.git/modules/`, and that of a
+      submodule keeping its own `.git` directory. `git describe` does not need
+      them, and each can hold a credential: a password in a remote URL, or the
+      token the CI checkout step stores there. A submodule whose name has a
+      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
+      git directory to `**/.git/modules/**/config`, and Go's version stamping
+      then fails the build: give it a name without that segment
+      (`git submodule add --name`). The stage that compiles has `git` (the
       Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
       takes the version from the `VERSION` build argument when one is given,
       otherwise from `git describe --tags --always`. That gives the tag on a