fix(canonical): apply .gitignore consistently across publisher and consumer content-hash walks

[detail-app]

Detail bug report: View on Detail

Bug

pcb-canonical computes a BLAKE3 content hash over a package's files, recorded by pcbc publish in an annotated git tag and recomputed by pcb-zen's resolver over the fetched package, which bails (verify_tag_hashes) if the two differ. The walker used ignore::WalkBuilder with defaults, so committed .gitignore rules were only applied when a .git/.jj directory existed above the walked root (ignore's default require_git(true)): the publisher walks inside the workspace git repo (.git present → .gitignore applied), while the consumer walks a git archive extract (.git absent → .gitignore ignored). For a tracked file matching a committed .gitignore rule (e.g. a force-added debug.log against *.log, or a file committed before being added to .gitignore), the two walks saw different file sets, so the hashes diverged and every consumer's verification failed — the package became unresolvable.

Fix

Set the walker to .require_git(false) so committed .gitignore is applied regardless of whether .git is present, and .git_global(false) / .git_exclude(false) to ignore the per-machine global gitignore and .git/info/exclude (neither is part of the committed tree and git archive ignores both, so honoring them was itself a divergence source). git_ignore(true) stays the default, so committed .gitignore is now honored identically on both sides — preserving the documented "Respect .gitignore" canonicalization rule — while the hash becomes environment-independent and matches what git archive actually emits.

Added a regression test (publisher_and_consumer_hashes_agree_for_tracked_but_ignored_file) that runs a real git round-trip: it force-adds debug.log against a *.log .gitignore, commits, hashes the in-repo dir as the publisher, extracts git archive HEAD into a .git-less tempdir as the consumer, and asserts both sides drop debug.log and produce equal hashes. This is the only test that exercises the publisher side with a real .git, closing the gap that let this bug go undetected.

Testing

• New regression test for the publisher/consumer hash divergence passes; the existing gitignore_patterns snapshot test now reflects .gitignore being applied in a non-git tempdir (the snapshot was updated to drop the previously-included ignored files — please review and approve that snapshot change).
• Full pcb-zen suite passes (112/112), including all other canonical snapshot tests (golden hash stability, nested-package exclusion, pcb.sum exclusion, single-file hashing, determinism).
• Workspace typecheck, clippy (-D warnings), and cargo fmt --check are clean; doctests pass.
• Publisher end-to-end pcbc tests (publish/release/tag) pass where the layout pipeline is not required; the remaining pcbc failures in this sandbox are pre-existing KiCad-version incompatibilities (footprint-library format and missing kicad-cli pcb drc/erc subcommands — the environment has KiCad 7.0.11, CI uses 10.0.5). A baseline comparison (same tests with the fix reverted under the same KiCad 7) produced the identical failures, confirming no regressions from this change.

---

Automatic Fixes PRs can be configured here.

---

Note

Medium Risk
Changes which files enter content hashes, so previously published tags can disagree until republished; this directly affects publish verification and dependency resolution integrity.

Overview
Aligns package content hashing so publish-time walks in a git repo and consumer walks over git archive extracts see the same files.

The canonical WalkBuilder now applies only package-local .gitignore / .ignore (.parents(false), .require_git(false)) and skips ancestor rules, global gitignore, and .git/info/exclude. That removes hash mismatches that broke tag verification when committed ignore rules were honored on one side but not the other.

Adds a git round-trip regression test (in-repo package dir vs archive extract) and updates the gitignore_patterns snapshot to match ignore behavior in non-git tempdirs. Docs and changelog note that older published hashes tied to ancestor or machine-local excludes may need a new package version.

^{Reviewed by Cursor Bugbot for commit 7cd15fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment

Left a non-blocking comment; no reviewers assigned. Cursor Bugbot’s check skipped and its review reported an unresolved finding, so this is not approved. The content-hash walker change is also not a small fixup.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Left a non-blocking comment; no reviewers assigned. Cursor Bugbot’s check skipped, so this is not approved. The content-hash walker change is also not a small fixup.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Left a non-blocking comment; no reviewers assigned. Cursor Bugbot’s check skipped, so this is not approved. The content-hash walker change is also not a small fixup.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Left a non-blocking comment; no reviewers assigned. Cursor Bugbot passed with no unresolved findings that need human review (Security Agent was not running). This is not approved because the content-hash walker change is not a small fixup.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Left a non-blocking comment; no reviewers assigned. Cursor Bugbot passed with no unresolved findings that need human review (Security Agent was not running). This is not approved because the content-hash walker change is not a small fixup.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7cd15fb. Configure here.}

[cursor]

Ancestor ignore skip hashes local junk

High Severity

.parents(false) stops the publisher from applying workspace .gitignore rules, so untracked files that Git ignores at the repo root are hashed. Consumers unpack git archive and never see those files, so verification fails and the package cannot be resolved.

 

^{Reviewed by Cursor Bugbot for commit 7cd15fb. Configure here.}

[cursor]

Left a non-blocking comment; no reviewers assigned. Cursor Bugbot’s check skipped, so this is not approved. The content-hash walker change is also not a small fixup.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}