Java .gitignore
Overview
Two jobs: initialize a correct .gitignore for a Java project, and audit a repo that has
already committed things it shouldn't. The expensive failure is a secret checked in — fixing the
.gitignore after the fact does NOT remove it from history.
What MUST be ignored
| Category |
Patterns |
| Secrets / local config (the costly leak) |
*.env, application-local.*, *-secret*.*, *.pem, *.p12, *.jks, *.keystore, credentials*, .envrc |
| Build output |
target/, build/, out/, bin/, *.class |
| Packaged artifacts |
*.jar, *.war, *.ear (except wrappers — below) |
| IDE files |
.idea/, *.iml, *.ipr, *.iws, .vscode/, .settings/, .classpath, .project, .metadata, nbproject/ |
| OS cruft |
.DS_Store, Thumbs.db, Desktop.ini |
| Logs / crash dumps |
*.log, hs_err_pid*, replay_pid* |
| Git/merge backups |
*.orig, *.BACKUP.*, *.LOCAL.*, *.REMOTE.* |
Drop in references/java.gitignore as a starting point (Maven + Gradle + IDE + OS + secrets).
What must NOT be ignored
Wrapper files — keep gradle/wrapper/gradle-wrapper.jar, gradle/wrapper/gradle-wrapper.properties,
and .mvn/wrapper/maven-wrapper.properties committed so ./gradlew / ./mvnw work for everyone.
A broad *.jar or build/ rule can swallow these — add negations:
!gradle/wrapper/gradle-wrapper.jar
!**/src/main/**/build/
Source, pom.xml/build.gradle, and .mvn/ config (other than timing.properties).
Initialize
One .gitignore at the repo root; module-specific files only if a module genuinely differs.
Copy references/java.gitignore, then trim to the project's build tool (Maven vs Gradle).
OS/IDE cruft is per-developer — a global excludes file keeps it out of every repo:
git config --global core.excludesfile ~/.gitignore_global # .DS_Store, .idea/, *.iml, etc.
Audit a repo (the handy part)
.gitignore only affects untracked files — anything already committed keeps being tracked even
if it now matches a pattern. To find and fix what was checked in by mistake:
# List tracked files that SHOULD be ignored (already committed but match .gitignore)
git ls-files --cached --ignored --exclude-standard
# Un-track exactly those files WITHOUT deleting your working copy, then commit.
# Drive git rm from the list above (don't guess paths — a non-tracked path aborts the whole command):
git ls-files --cached --ignored --exclude-standard -z | xargs -0 git rm --cached
git commit -m "chore: stop tracking ignored files"
Files covered by a global excludes file (.idea/, .DS_Store) won't appear here — that's fine.
Sanity sweeps for common mistakes:
git ls-files | grep -E '\.(class|jar|war|log|iml)$|(^|/)(target|build|out|bin)/|\.idea/'
git ls-files | grep -iE 'secret|credential|\.env$|application-local|\.(pem|p12|jks|keystore)$'
Secrets already committed — important
git rm --cached removes a file from the current commit, not from history — the secret is
still recoverable from earlier commits. If a real secret was committed:
- Rotate the secret immediately (assume it's compromised). This is the only true fix.
- Then scrub history with
git filter-repo (or BFG), and force-push (coordinate with the team).
- Add the pattern to
.gitignore so it can't recur.
Red flags — stop
target//build//.class/.idea/ showing up in git status as tracked- A
*.env, application-local.*, keystore, or credentials* file staged or committed
- A broad ignore (
*.jar, build/) with no negation for the wrapper jar
- "I'll just
git rm --cached the secret" — that doesn't remove it from history; rotate it
1---2name: java-gitignore3description: Use when initializing or auditing a Java project's .gitignore, or when the wrong files were committed — build output, IDE files, OS cruft, or (worst) secrets/local config. Covers what must and must NOT be ignored, a ready Maven+Gradle template, and how to find and un-track files already checked in by mistake (git rm --cached) including the secrets-in-history caveat.4---56# Java .gitignore78## Overview910Two jobs: **initialize** a correct `.gitignore` for a Java project, and **audit** a repo that has11already committed things it shouldn't. The expensive failure is a **secret** checked in — fixing the12`.gitignore` after the fact does NOT remove it from history.1314## What MUST be ignored1516| Category | Patterns |17|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------|18| **Secrets / local config** (the costly leak) | `*.env`, `application-local.*`, `*-secret*.*`, `*.pem`, `*.p12`, `*.jks`, `*.keystore`, `credentials*`, `.envrc` |19| Build output | `target/`, `build/`, `out/`, `bin/`, `*.class` |20| Packaged artifacts | `*.jar`, `*.war`, `*.ear` (except wrappers — below) |21| IDE files | `.idea/`, `*.iml`, `*.ipr`, `*.iws`, `.vscode/`, `.settings/`, `.classpath`, `.project`, `.metadata`, `nbproject/` |22| OS cruft | `.DS_Store`, `Thumbs.db`, `Desktop.ini` |23| Logs / crash dumps | `*.log`, `hs_err_pid*`, `replay_pid*` |24| Git/merge backups | `*.orig`, `*.BACKUP.*`, `*.LOCAL.*`, `*.REMOTE.*` |2526Drop in `references/java.gitignore` as a starting point (Maven + Gradle + IDE + OS + secrets).2728## What must NOT be ignored2930- **Wrapper files** — keep `gradle/wrapper/gradle-wrapper.jar`, `gradle/wrapper/gradle-wrapper.properties`,31 and `.mvn/wrapper/maven-wrapper.properties` committed so `./gradlew` / `./mvnw` work for everyone.32 A broad `*.jar` or `build/` rule can swallow these — add negations:3334 ```gitignore35 !gradle/wrapper/gradle-wrapper.jar36 !**/src/main/**/build/37 ```3839- Source, `pom.xml`/`build.gradle`, and `.mvn/` config (other than `timing.properties`).4041## Initialize42431. One `.gitignore` at the repo root; module-specific files only if a module genuinely differs.442. Copy `references/java.gitignore`, then trim to the project's build tool (Maven vs Gradle).453. OS/IDE cruft is per-developer — a **global** excludes file keeps it out of every repo:4647 ```bash48 git config --global core.excludesfile ~/.gitignore_global # .DS_Store, .idea/, *.iml, etc.49 ```5051## Audit a repo (the handy part)5253`.gitignore` only affects **untracked** files — anything already committed keeps being tracked even54if it now matches a pattern. To find and fix what was checked in by mistake:5556```bash57# List tracked files that SHOULD be ignored (already committed but match .gitignore)58git ls-files --cached --ignored --exclude-standard5960# Un-track exactly those files WITHOUT deleting your working copy, then commit.61# Drive git rm from the list above (don't guess paths — a non-tracked path aborts the whole command):62git ls-files --cached --ignored --exclude-standard -z | xargs -0 git rm --cached63git commit -m "chore: stop tracking ignored files"64```6566> Files covered by a **global** excludes file (`.idea/`, `.DS_Store`) won't appear here — that's fine.6768Sanity sweeps for common mistakes:6970```bash71git ls-files | grep -E '\.(class|jar|war|log|iml)$|(^|/)(target|build|out|bin)/|\.idea/'72git ls-files | grep -iE 'secret|credential|\.env$|application-local|\.(pem|p12|jks|keystore)$'73```7475## Secrets already committed — important7677`git rm --cached` removes a file from the **current** commit, **not from history** — the secret is78still recoverable from earlier commits. If a real secret was committed:79801. **Rotate the secret immediately** (assume it's compromised). This is the only true fix.812. Then scrub history with `git filter-repo` (or BFG), and force-push (coordinate with the team).823. Add the pattern to `.gitignore` so it can't recur.8384## Red flags — stop8586- `target/`/`build/`/`.class`/`.idea/` showing up in `git status` as tracked87- A `*.env`, `application-local.*`, keystore, or `credentials*` file staged or committed88- A broad ignore (`*.jar`, `build/`) with no negation for the wrapper jar89- "I'll just `git rm --cached` the secret" — that doesn't remove it from history; rotate it
mtkhawaja