Problem
The repository's .buildignore excludes .datamachine/ but not the gitignored root artifacts/ directory. Homeboy's WordPress build uses .buildignore as the complete rsync exclusion list, so retained WP Codebox evidence is copied into production ZIPs.
Reproduction
From PR #3361 head 3a68221ec, retain a WP Codebox runtime pointer under artifacts/, then run:
homeboy review build data-machine --path <worktree>
unzip -Z1 build/data-machine.zip | grep '^data-machine/artifacts/'
Observed package:
- SHA256:
99f9523fa534f6db4c4b250f8f8cb85515b9f363ad77bfcb63b945ecc6d12d4b
- Entries: 2,130
- Seven unwanted
data-machine/artifacts/ entries, including runtime manifests and request-worker.php
The clean package before evidence leakage had 2,123 entries.
Expected
Root runtime evidence must remain retained locally but always be excluded from production ZIPs through .buildignore.
Proposed fix
Add the root artifacts/ directory to .buildignore and verify a package build contains no data-machine/artifacts/ entries.
AI assistance
- AI assistance: Yes
- Tool: OpenCode
- Used for: Reproduction, ZIP inventory inspection, and issue drafting.
Problem
The repository's
.buildignoreexcludes.datamachine/but not the gitignored rootartifacts/directory. Homeboy's WordPress build uses.buildignoreas the complete rsync exclusion list, so retained WP Codebox evidence is copied into production ZIPs.Reproduction
From PR #3361 head
3a68221ec, retain a WP Codebox runtime pointer underartifacts/, then run:Observed package:
99f9523fa534f6db4c4b250f8f8cb85515b9f363ad77bfcb63b945ecc6d12d4bdata-machine/artifacts/entries, including runtime manifests andrequest-worker.phpThe clean package before evidence leakage had 2,123 entries.
Expected
Root runtime evidence must remain retained locally but always be excluded from production ZIPs through
.buildignore.Proposed fix
Add the root
artifacts/directory to.buildignoreand verify a package build contains nodata-machine/artifacts/entries.AI assistance