# Keeping Git Repos Clean

> Previene, detecta y corrige la subida a git de secretos (.env, API tokens, credenciales) y artefactos dev (builds, BD de trabajo, editor/SO). Cubre .gitignore (por qué no deja de trackear), git rm --cached, auditoría, historial y rotación.

Fuente: https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/keeping-git-repos-clean
Markdown: https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/keeping-git-repos-clean.md

Repositorio: https://github.com/kajisho5/ffmpeg-skill
Autor: kajisho5
Licencia: MIT
Actualizado: hace 4 días
Coste de contexto: 116 tok instalada, 2.1k tok al activarse, 2.1k tok con todos los archivos del bundle
Bundle: 1 archivo, 8 KB
Permisos que pide: ninguno declarado

## Instalación

Un skill son archivos markdown: los mismos archivos valen para cualquier agente y lo único que cambia es el directorio de destino, es decir la bandera `--agent`. Añade `-g` para instalarlo en todos los proyectos de la máquina.

```bash
# Claude Code
npx -y skills add kajisho5/ffmpeg-skill --skill git-hygiene --agent claude-code
# Cursor
npx -y skills add kajisho5/ffmpeg-skill --skill git-hygiene --agent cursor
# Codex
npx -y skills add kajisho5/ffmpeg-skill --skill git-hygiene --agent codex
# Gemini CLI
npx -y skills add kajisho5/ffmpeg-skill --skill git-hygiene --agent gemini
# Windsurf
npx -y skills add kajisho5/ffmpeg-skill --skill git-hygiene --agent windsurf
# Cline
npx -y skills add kajisho5/ffmpeg-skill --skill git-hygiene --agent cline
```

## Qué hace

- Audita el índice de git con git ls-files para localizar secretos y artefactos de desarrollo que ya están trackeados.
- Deja claro que .gitignore no deja de trackear archivos ya commiteados y usa git rm --cached para deshacer ese seguimiento sin borrarlos del disco.
- Exige rotar cualquier credencial que haya podido publicarse antes de reescribir el historial con git filter-repo o BFG.
- Añade defensas preventivas: .gitignore global (core.excludesFile) y hooks de pre-commit con gitleaks o detect-secrets.
- Enseña a verificar sin ensuciar el árbol: git status antes y después, stagear solo rutas revisadas y evitar git add -A.

## Cuándo usarla

- Cuando un repo tiene secretos, builds o basura ya commiteados y hay que localizarlos y remediarlos.
- Al crear un repo nuevo y decidir qué reglas de .gitignore y qué hooks de prevención configurar.
- Al revisar qué archivos trackea realmente un repo antes de hacerlo público o desplegarlo.
- Cuando un comando de build o de tests genera artefactos en el working tree y quieres limpiarlo sin perder trabajo.

## Cuándo no

- Para escanear el código fuente buscando vulnerabilidades o patrones de secretos; para eso está el skill /security-review.

## Qué la activa

- "He commiteado un .env con una API key por error: ¿cómo lo quito del repo y qué hago con la credencial?"
- "Crea un .gitignore para un proyecto Python nuevo y configúrame gitleaks como pre-commit."
- "¿Qué ficheros está trackeando realmente este repositorio?"
- "Tras ejecutar los tests han aparecido __pycache__ y un PDF modificado; ¿cómo lo limpio sin tocar otros cambios?"
- "Configura un ignore global para .DS_Store, todo.db y *.profraw."

## Antes de instalar

- Requiere git; para bloquear secretos en el commit, gitleaks o detect-secrets; para reescribir historial, git filter-repo o BFG.
- Necesita en el PATH: git
- makes network requests

## Archivos

- SKILL.md — 8 KB

## SKILL.md

Reproducido tal cual desde kajisho5/ffmpeg-skill bajo MIT. Esta sección es el documento original y está en inglés.

# Keeping Git Repos Clean

Two classes of files keep ending up in repos: **secrets** and **dev artifacts**.
Both are cheap to prevent and expensive to clean up after the fact, because git
history is forever and public repos publish everything.

## The one rule everyone forgets

**`.gitignore` does NOT untrack files that are already committed.** Adding a path
to `.gitignore` only prevents *future untracked* files from being staged. A file
git is already tracking keeps getting committed regardless. This bites repeatedly:
a `.env` is listed in `.gitignore` but was committed before the rule existed, so
it keeps shipping.

To actually stop tracking a file while keeping your local copy:

```bash
git rm --cached path/to/file        # untrack, leave working-tree copy in place
git rm -r --cached some/dir/        # for a directory
echo "path/to/file" >> .gitignore   # then ignore it so it doesn't come back
git commit -m "Stop tracking <file>; add to .gitignore"
```

`--cached` is the important flag — plain `git rm` deletes the working copy too.

## Audit what a repo actually tracks

Don't trust `.gitignore` to tell you what's clean — read the index directly:

```bash
git ls-files | grep -iE '\.(env|pem|key|p12|profraw|log|bak|db|sqlite3?)$'
git ls-files | grep -iE '(^|/)(\.DS_Store|~\$|todo\.db|node_modules/|__pycache__/)'
git ls-files '*.db' '*.sqlite*'                 # scratch databases
git ls-files | xargs -I{} du -h {} | sort -rh | head   # surprisingly large tracked files
```

Usual suspects seen across real repos:

- **Secrets:** `.env` with a live token, hardcoded `AWS_*`/DB creds in a settings
  module, `SECRET_KEY = "CHANGEME"`/`"foobar"` placeholders shipped to prod.
- **Build artifacts:** LaTeX `.aux/.toc/.log/.synctex.gz/.pdf`, LLVM `*.profraw`,
  compiled binaries, `htmlcov/`, `dist/`, `*.egg-info/`.
- **Scratch / personal artifacts:** `todo.db` and other tool-local SQLite scratch
  DBs, editor backups (`*.backup`, `*.bak`, `~$*.docx` Word lock files), stray
  `*.log`.
- **OS noise:** `.DS_Store`, `Thumbs.db`.

## Secrets need more than `git rm`

Removing a secret from `HEAD` does **not** remove it from history — `git log -p`
and the commit that introduced it still expose it. Three things must happen, in
order, and the first is the only one that actually protects you:

1. **Rotate the credential.** Treat any secret that ever touched a remote as
   compromised. Issue a new token/key/password and revoke the old one. Do this
   first — the leaked value is public the moment it was pushed.
2. **Untrack going forward** (`git rm --cached` + `.gitignore` + `.env.example`
   documenting which vars are needed, with placeholder values only).
3. **Scrub history** if required (`git filter-repo --invert-paths --path .env`,
   or BFG) and force-push. This rewrites SHAs and disrupts collaborators, so it's
   usually a deliberate maintainer step done after rotation — not an automated PR.

A PR that does (2) and (3) but skips (1) gives false comfort: the value is still
valid and still in history clones/forks. Always call out rotation as the required
human follow-up.

## "Committed" means "published"

For public repos — and especially static sites deployed with `path: '.'`
(GitHub Pages uploads the entire repo) — every tracked file is fetchable at a
public URL. A scratch `todo.db` at the repo root of a brochure site is served at
`/todo.db`. Before committing to any public repo, assume anyone can download it.

## Prevent it: global ignore + a secret scanner

Per-developer noise (editor files, OS files, tool scratch DBs like `todo.db`)
should be ignored **globally**, not in every project's `.gitignore` — that way it
never lands anywhere:

```bash
git config --global core.excludesFile ~/.gitignore_global
printf '%s\n' '.DS_Store' '*.swp' 'todo.db' '*.profraw' >> ~/.gitignore_global
```

Block secrets at commit time with a pre-commit hook so they never reach history:

```yaml
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks: [{id: gitleaks}]
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0
    hooks: [{id: detect-secrets, args: ["--baseline", ".secrets.baseline"]}]
```

A starter project `.gitignore` (commit this):

```gitignore
# Secrets / local config
.env
.env.*
!.env.example
*.pem
*.key

# Python build/test artifacts
__pycache__/
*.py[cod]
build/
dist/
*.egg-info/
.coverage
htmlcov/
.pytest_cache/

# Scratch / OS / editor
*.db
*.sqlite
*.sqlite3
*.profraw
*.log
*.bak
*.backup
.DS_Store
~$*
```

## Verification can dirty the tree

Compilers, test runners, and asset pipelines often write into the checkout even
when the command is only meant to verify a change. They may create unignored
cache files or regenerate a tracked distributable such as a PDF or compiled CSS.
A green command does not mean the working tree still contains only your change.

Bracket verification with status checks and stage only reviewed paths:

```bash
git status --short
make test                         # or the project's real build command
git status --short
git diff -- path/you/changed
git add path/you/changed          # never sweep in generated files with git add -A
git diff --cached --check
git diff --cached --stat
```

If a tool necessarily produces noisy output, run it in a disposable copy of the
checkout. This preserves a real build while keeping generated files away from
the patch:

```bash
scratch_dir=$(mktemp -d)
rsync -a --exclude .git ./ "$scratch_dir/"
(cd "$scratch_dir" && make build)
```

When verification modifies a tracked generated output that is intentionally out
of scope, restore **that exact path only after reviewing its diff**:

```bash
git diff -- docs/manual.pdf
git restore -- docs/manual.pdf
```

Do not use a broad restore/reset to clean up: the checkout may already contain
someone else's work. Also do not rely on `git stash` as cleanup for untracked
artifacts; ordinary stashes omit them, and even `--include-untracked` can collide
with files regenerated before `stash pop`. Prevent or remove known generated
paths explicitly instead.

## Checklist

```
Audit:
- [ ] `git ls-files` reviewed for secrets, build output, scratch DBs, OS files
- [ ] No live credentials in tracked source or .env
- [ ] No surprisingly large/binary tracked files

Remediate (if dirty):
- [ ] Secret rotated/revoked FIRST (history is public the moment it was pushed)
- [ ] `git rm --cached` + .gitignore entry for each offending file
- [ ] .env.example documents required vars with placeholder values only
- [ ] History scrub flagged as a maintainer follow-up if the secret is in history

Prevent:
- [ ] Project .gitignore covers secrets, build artifacts, OS/editor noise
- [ ] Global core.excludesFile catches per-developer scratch files
- [ ] gitleaks / detect-secrets pre-commit hook installed
- [ ] Verification bracketed by `git status --short`; only reviewed paths staged
```

For scanning source code for vulnerabilities and hardcoded-secret *patterns*
rather than what git tracks, use the `/security-review` skill already available
in this session.

## Note for this repository (ffmpeg-skill)

`.gitignore` already covers `__pycache__/`, and `package.json`'s `"files"` list
is the actual publish gate — but this session hit exactly the "verification can
dirty the tree" case: running `python3 scripts/proxy.py` and the test suites
locally created `__pycache__/*.pyc` files that then showed up in an `npm
publish --dry-run` listing before they were deleted. The `git status --short`
bracket-and-check habit above (or, cheaper here, just re-running the dry-run
after deleting stray `__pycache__/` directories) is the concrete fix. There
are no secrets or `.env`-shaped files in this repo (no cloud/API keys by
design), so the credential-rotation half of this skill does not currently
apply — the dev-artifact half is the one worth watching.

Source: [wdm0006/python-skills](https://github.com/wdm0006/python-skills) (MIT).

## Dónde encaja

- Categoría: [Herramientas para desarrolladores](https://skillsagentes.com/categorias/herramientas-desarrollo.md) — Skills que cambian cómo tu agente escribe, revisa y despliega código.
- Creador: [kajisho5](https://skillsagentes.com/creators/kajisho5.md) — 0 skills en el directorio
- [Todas las skills](https://skillsagentes.com/skills.md)
- [Ranking de instalaciones](https://skillsagentes.com/ranking.md)

## Otras skills del mismo repositorio

- [Ffmpeg Skill](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/ffmpeg-skill.md): Edita vídeo y audio con FFmpeg local desde lenguaje natural: cortes, unión, reframe 9:16/1:1, velocidad, subtítulos, overlays, multicámara/sync, LUFS, HDR→SDR, LUTs, export y verificación. Python 3.9 stdlib, sin nube ni API keys.
- [Concurrent Branches](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/concurrent-branches.md): Resuelve conflictos de merge con varias ramas abiertas: unión, recomputación y reconstrucción como resoluciones correctas; artefactos generados, serialización no determinista e IDs renumerados; un auto-merge limpio no es un test que pasa.
- [Ci Pipeline Synthesizer](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/ci-pipeline-synthesizer.md): Genera configuraciones de CI/CD para GitHub Actions: compilación y pruebas de librerías y paquetes. Úsalo al crear o actualizar workflows de npm, Python, Go o Rust con caché de dependencias, pruebas en matriz y publicación de artefactos.
- [Guarding Destructive Operations](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/guarding-destructive-operations.md): Guarda operaciones destructivas: borrados, sobrescrituras, reescritura de historial o resolución de nombres a rutas; rechaza en vez de avisar, comprueba antes de mutar, clasifica por estructura y prueba cada mitad.
- [Building Python Mcp Servers](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/building-python-mcp-servers.md): Crea servidores MCP robustos en Python con FastMCP: diseño de herramientas, contratos de error, trabajo bloqueante, subprocesos/CLI, distribución, pruebas e inyección de prompts. Úsalo al escribir, exponer, depurar o probar servidores MCP.

## Skills relacionadas

- [Building Python Mcp Servers](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/building-python-mcp-servers.md): Crea servidores MCP robustos en Python con FastMCP: diseño de herramientas, contratos de error, trabajo bloqueante, subprocesos/CLI, distribución, pruebas e inyección de prompts. Úsalo al escribir, exponer, depurar o probar servidores MCP.
- [Concurrent Branches](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/concurrent-branches.md): Resuelve conflictos de merge con varias ramas abiertas: unión, recomputación y reconstrucción como resoluciones correctas; artefactos generados, serialización no determinista e IDs renumerados; un auto-merge limpio no es un test que pasa.
- [Guarding Destructive Operations](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/guarding-destructive-operations.md): Guarda operaciones destructivas: borrados, sobrescrituras, reescritura de historial o resolución de nombres a rutas; rechaza en vez de avisar, comprueba antes de mutar, clasifica por estructura y prueba cada mitad.
- [Managing Python Releases](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/managing-python-releases.md): Gestiona lanzamientos de librerías Python: versionado semántico, changelog (Keep a Changelog), automatización con GitHub Actions y deprecaciones. Úsalo al planificar lanzamientos, escribir changelogs o comunicar breaking changes.
- [Reproducing Ci Locally](https://skillsagentes.com/skills/kajisho5/ffmpeg-skill/reproducing-ci-locally.md): Reproduce el gate de CI en local a partir del workflow: comando, rutas, marcadores y entorno exactos; desbloquea pasos cortocircuitados, fija la versión del linter que resuelve CI y confirma que el run es verde.

---

Skills Agentes · [Índice de páginas en markdown](https://skillsagentes.com/sitemap.md) · [Inicio](https://skillsagentes.com/index.md)