Keep a submodule's own .git/config out of the build context (closes #88)

The canonical .dockerignore kept out .git/config and the configs under
.git/modules/, but not the config of a submodule that keeps its own .git
directory, so its credential reached the image. Both git patterns now
carry the **/ prefix.

A submodule named config or deploy/config still loses its whole git
directory, and Go's version stamping fails the build. Closing that needs
a wildcard re-include, which makes BuildKit walk every excluded directory
on every build, so the file records it as a KNOWN GAP with the remedy,
git submodule add --name. REPO_POLICIES.md and both checklists say the
same.

Model: opus-5-5

.dockerignore

@@ -18,9 +18,14 @@
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
 # Each submodule keeps a config with the same exposure in its git directory
-# under .git/modules/, nested again for a submodule's own submodules.
+# under .git/modules/, nested again for a submodule's own submodules, or in
-.git/config
+# its own .git directory when it keeps one.
-.git/modules/**/config
+# KNOWN GAP: `**/.git/modules/**/config` also matches the git directory
+# of a submodule named `config` or `deploy/config`, so all of it stays
+# out and Go's version stamping fails the build; nothing leaks. Name
+# such a submodule without that segment: `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
 
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.

TODO.md

@@ -21,6 +21,15 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-04: The canonical `.dockerignore` now also keeps out the git `config`
+  of a submodule that keeps its own `.git` directory, which still reached the
+  image (issue 88): both git patterns now carry the `**/` prefix. A submodule
+  named `config` or `deploy/config` still loses its whole git directory, so Go's
+  version stamping fails the build; the file records this as a `KNOWN GAP:` with
+  the remedy, `git submodule add --name`. Closing it would take a wildcard
+  re-include, which makes BuildKit walk every excluded directory, such as
+  `node_modules`, on every build. `REPO_POLICIES.md` and both checklists say so
+  in the same words.
 - 2026-10-04: `REPO_POLICIES.md` now says how a Go tool a repo needs on the host
   is pinned (issue 37): installed with `go install` pinned to a commit hash,
   never tracked as a `go.mod` tool dependency or through a `tools.go` file.

prompts/EXISTING_REPO_CHECKLIST.md

@@ -63,22 +63,26 @@ with your task.
       here run anywhere other than the repo root, the anchored entry misses
       `services/api/.claude/`: add anchored entries for those directories.
 - [ ] If the repo embeds a version in a binary: `.dockerignore` lets `.git` into
-      the build context. It keeps out `.git/config` and each submodule's
+      the build context. It keeps out every git `config` at any depth
-      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
+      (`**/.git/config`, `**/.git/modules/**/config`): the repository's own,
-      which `git describe` does not need and which can hold a credential: a
+      each submodule's under `.git/modules/`, and that of a submodule keeping
-      password in a remote URL, or the token the CI checkout step stores there.
+      its own `.git` directory. `git describe` does not need them, and each can
-      The stage that compiles has `git` (the Debian Go image has it; an alpine
+      hold a credential: a password in a remote URL, or the token the CI
-      one needs `apk add --no-cache git`) and takes the version from the
+      checkout step stores there. A submodule named `config` or `deploy/config`
-      `VERSION` build argument when one is given, otherwise from
+      loses its whole git directory to `**/.git/modules/**/config`, and Go's
-      `git describe --tags --always`. That gives the tag on a tagged commit; on
+      version stamping then fails the build: give it a name without that segment
-      a later commit, the tag, the number of commits since it and the short
+      (`git submodule add --name`). The stage that compiles has `git` (the
-      commit (`v1.2.3-4-gabc1234`); and the short commit when no tag is
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
-      reachable. The stage that compiles also marks its working directory safe
+      takes the version from the `VERSION` build argument when one is given,
-      for git (`git config --system --add safe.directory /src`): a context sent
+      otherwise from `git describe --tags --always`. That gives the tag on a
-      as a tar stream keeps the sender's file owners, and git refuses a checkout
+      tagged commit; on a later commit, the tag, the number of commits since it
-      owned by another user, so the version would come out empty. `ARG VERSION`
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
-      has no default, and the build fails if the context carries `.git` and the
+      tag is reachable. The stage that compiles also marks its working directory
-      version still comes out empty, `dev` or `unknown`. A plain
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
       `script/docker` and `script/cibuild` pass the version they compute on the

prompts/NEW_REPO_CHECKLIST.md

@@ -71,22 +71,26 @@ Template files can be fetched from:
       will run them in subdirectories, `services/api/.claude/` needs its own
       anchored entry.
     - If the image embeds a version in a binary: `.dockerignore` lets `.git`
-      into the build context. It keeps out `.git/config` and each submodule's
+      into the build context. It keeps out every git `config` at any depth
-      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
+      (`**/.git/config`, `**/.git/modules/**/config`): the repository's own,
-      which `git describe` does not need and which can hold a credential: a
+      each submodule's under `.git/modules/`, and that of a submodule keeping
-      password in a remote URL, or the token the CI checkout step stores there.
+      its own `.git` directory. `git describe` does not need them, and each can
-      The stage that compiles has `git` (the Debian Go image has it; an alpine
+      hold a credential: a password in a remote URL, or the token the CI
-      one needs `apk add --no-cache git`) and takes the version from the
+      checkout step stores there. A submodule named `config` or `deploy/config`
-      `VERSION` build argument when one is given, otherwise from
+      loses its whole git directory to `**/.git/modules/**/config`, and Go's
-      `git describe --tags --always`. That gives the tag on a tagged commit; on
+      version stamping then fails the build: give it a name without that segment
-      a later commit, the tag, the number of commits since it and the short
+      (`git submodule add --name`). The stage that compiles has `git` (the
-      commit (`v1.2.3-4-gabc1234`); and the short commit when no tag is
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
-      reachable. The stage that compiles also marks its working directory safe
+      takes the version from the `VERSION` build argument when one is given,
-      for git (`git config --system --add safe.directory /src`): a context sent
+      otherwise from `git describe --tags --always`. That gives the tag on a
-      as a tar stream keeps the sender's file owners, and git refuses a checkout
+      tagged commit; on a later commit, the tag, the number of commits since it
-      owned by another user, so the version would come out empty. `ARG VERSION`
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
-      has no default, and the build fails if the context carries `.git` and the
+      tag is reachable. The stage that compiles also marks its working directory
-      version still comes out empty, `dev` or `unknown`. A plain
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
     - The Dockerfile carries a `lint` phase and a `test` phase, each invoking

prompts/REPO_POLICIES.md

@@ -238,22 +238,27 @@ style conventions are in separate documents:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
     - If the project requires CGO or system libraries for linting (e.g.
       `vips-dev`), install them in the lint phase with `apk add`.
-    - `.dockerignore` lets `.git` into the build context. It keeps out
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
-      `.git/config` and each submodule's `config` under `.git/modules/` at any
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
-      depth (`.git/modules/**/config`), which `git describe` does not need and
+      repository's own, each submodule's under `.git/modules/`, and that of a
-      which can hold a credential: a password in a remote URL, or the token the
+      submodule keeping its own `.git` directory. `git describe` does not need
-      CI checkout step stores there. The stage that compiles has `git` (the
+      them, and each can hold a credential: a password in a remote URL, or the
-      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
+      token the CI checkout step stores there. A submodule named `config` or
-      takes the version from the `VERSION` build argument when one is given,
+      `deploy/config` loses its whole git directory to
-      otherwise from `git describe --tags --always`. That gives the tag on a
+      `**/.git/modules/**/config`, and Go's version stamping then fails the
-      tagged commit; on a later commit, the tag, the number of commits since it
+      build: give it a name without that segment (`git submodule add --name`).
-      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
+      The stage that compiles has `git` (the Debian Go image has it; an alpine
-      tag is reachable. The stage that compiles also marks its working directory
+      one needs `apk add --no-cache git`) and takes the version from the
-      safe for git (`git config --system --add safe.directory /src`): a context
+      `VERSION` build argument when one is given, otherwise from
-      sent as a tar stream keeps the sender's file owners, and git refuses a
+      `git describe --tags --always`. That gives the tag on a tagged commit; on
-      checkout owned by another user, so the version would come out empty.
+      a later commit, the tag, the number of commits since it and the short
-      `ARG VERSION` has no default, and the build fails if the context carries
+      commit (`v1.2.3-4-gabc1234`); and the short commit when no tag is
-      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
+      reachable. The stage that compiles also marks its working directory safe
+      for git (`git config --system --add safe.directory /src`): a context sent
+      as a tar stream keeps the sender's file owners, and git refuses a checkout
+      owned by another user, so the version would come out empty. `ARG VERSION`
+      has no default, and the build fails if the context carries `.git` and the
+      version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.