From 30ce3c6715c9d1dfe4aa79ac5bf96bb1e15edd77 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Sun, 7 Jun 2026 15:07:30 -0700 Subject: [PATCH] chore(terraform): gitignore tfplan.* and *.tfplan.* to block plan binary commits Commit afea1b7fa accidentally committed a binary Terraform plan file (terraform/environments/aws/ci-cd-permissions/tfplan.lt, 26 KB) that can contain sensitive resource and state details. Root cause: .gitignore had `tfplan` (exact name) and `*.tfplan` (suffix), but not `tfplan.*`, so `tfplan.lt` slipped through. Add the missing patterns to both the root .gitignore and terraform/.gitignore: - `tfplan.*` catches plan files with arbitrary extensions (e.g. .lt, .out) - `*.tfplan.*` catches double-extension variants (e.g. foo.tfplan.gz) The binary artifact itself (tfplan.lt) must be removed from any branch that carries afea1b7fa before that branch merges; see the linked issue. --- .gitignore | 2 ++ terraform/.gitignore | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 80474a698..a16630aed 100644 --- a/.gitignore +++ b/.gitignore @@ -104,7 +104,9 @@ backend.hcl # Terraform plan files tfplan +tfplan.* *.tfplan +*.tfplan.* # Terraform state and outputs terraform-apply-*.txt diff --git a/terraform/.gitignore b/terraform/.gitignore index b11af29cc..c339229ee 100644 --- a/terraform/.gitignore +++ b/terraform/.gitignore @@ -33,8 +33,10 @@ terraform.rc !.terraform.lock.hcl # Plan files +tfplan +tfplan.* *.tfplan -*.tfplan.json +*.tfplan.* # Environment-specific variable files environments/**/terraform.tfvars