Exclude gitignored files from App Security discovery

[jek]

WHY are these changes introduced?

shopify app security check scanned files that git ignores, such as local .env files and generated output. That produced findings, including committed-secret findings, for files that never reach the repository.

WHAT is this pull request doing?

Discovery now skips paths that git ignores. It asks git once for the app's untracked, ignored paths (git ls-files --others --ignored --exclude-standard --directory), so nested .gitignore files, negations, .git/info/exclude and global excludes all apply. Tracked files that match .gitignore are still scanned.

To support this, discovery walks the app root once with a single matcher, instead of running a separate glob per file type. The matcher combines the default exclusions with git's ignored paths and prunes excluded folders during the walk. #8702 builds on it to add --ignore, whose patterns override both, for example !build/ to scan a folder that's excluded by default.

Changes that follow from the new walker:

• Dot-folders are now scanned; previously none were. .github/ and .vscode/ are checked for secrets. Generated dot-folders (.next/, .nuxt/, .yarn/, .cache/, …) are default exclusions, which --ignore can override in Add --ignore to app security check and instructions #8702. .shopify/ is excluded as a whole, so it stays unscanned; before, only .shopify/app-security/ was listed, which made no difference because dot-folders were skipped anyway.
• Dependabot and Renovate config follows the same exclusions, so an ignored config file doesn't count as dependency automation.
• The committed-secret check no longer checks ignore status itself, because discovery does. When a file git ignores is still scanned, the finding says why. The check's version goes from 2 to 3.
• Exclusions aren't recorded in the trace or submission, matching the existing default exclusions.

Edge cases

Much of the diff is tests for these, found during development and review:

• An enclosing repository ignores the app folder: git's rules aren't applied. That repository doesn't own the app, and applying its rules would empty the scan and report the app clean. The check uses git check-ignore --no-index, so a force-tracked file inside the app doesn't hide it.
• Whitelist-style .gitignore (*, then !src/): the repository's top level and folders included again aren't treated as ignored.
• Nested git repository inside the app: scanned when the app's repository doesn't ignore it, because the app repository's rules don't reach inside it. When the app's repository ignores it, directly or through a parent folder, it's excluded like any ignored folder.
• No repository, git missing, or git refuses the repository (dubious ownership, corrupt config): no git exclusions apply. A .git marker check tells "no repository" apart from "git failed" without parsing git's localized error messages.
• App folder inside .git: treated as not in a repository.
• Git worktrees: .git is excluded both as a folder and as the file that worktrees use.
• Filenames with gitignore-significant characters ([id].ts, #hash.ts): git's ignored paths are matched literally.
• Selected app configuration file: loaded and scanned for secrets even when git ignores it (shopify.app.staging.toml) or a default exclusion matches it (*.test.* matches shopify.app.test.toml).
• Symlinked folders: listed but not traversed.
• Nested apps: still skipped, even when their configuration file is excluded.
• Unignored node_modules/: git's listing skips the default folders, so it stays fast.

How to manually test your changes?

In a git-tracked app:

1. Add .env to .gitignore, and put a Shopify token-shaped value (shpat_ followed by 32 hex characters) in .env.
2. pnpm shopify app security check --path /path/to/app: no committed-secret finding for .env.
3. git -C /path/to/app add -f .env, then rerun: the finding appears, because tracked files are scanned.
4. Put the same value in .github/workflows/deploy.yml and rerun: it's reported.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[isaacroldan]

Sorry to ask, but why is a change to exclude gitignored files, a +2000 line change?
I'm sure this can be simplified?

[jek]

Sorry to ask, but why is a change to exclude gitignored files, a +2000 line change? I'm sure this can be simplified?

Fair question! The PR description didn't do a good job cataloging the knock-on effects this had and the edge cases closed. Updated that description & trimmed a lot of comment fat as well.

[dmerand]

Thanks for the changes + description updates. I have a few LLM comments below but overall it looks good.