# Web UI upload staging (server.py writes uploads + extracted/cloned trees here)
.uploads/

# SBOM Output Files
*_bom.json
*.sbom.json
bom.json
*_bom.json.sig
*_bom.spdx.json
*_bom.spdx.json.sig
# Scan deliverables ({project}_{version}_...)
*_NOTICE.txt
*_NOTICE.html
*_risk-report.md
*_risk-report.html
*_security.json
*_security.md
*_security.html
*_conformance.json
*_conformance.md
*_conformance.html
*_conformance.result
*_gate.result
*_summary.result
*_scancode.json
*_NOTICE.pdf
*_security_epss.json
*_vendored.cdx.json
*_modelica.cdx.json
*_cocoapods.cdx.json
*_conda.cdx.json
*_files.json
*_source.json
*_input.json
*_yocto_vex.json
*_security_yocto.json
*_ai-profile.json
*_ai-profile.md
*_vex.json
*_vex.cdx.json
*_vex_imported.json
*_bom.spdx3.json
*_bom.spdx3.json.sig
*_spdx3-check.json
*_spdx3-check.md
*_ai-declaration.json
*_ai-declaration.template.json
*_component-versions.template.csv
*_security_cvebintool.json
*_security_grype.json
*_security_trivy.json
*_reachability.cdx.json
*_bom.refused.json
*_govulncheck_stage1.json
*_govulncheck_stage1.err
*_govulncheck_stage1.rc
bomlens-result.json
bomlens-events.jsonl
*.wfp
.scanmeta.json

# Sample scanner reports shipped with the docs are tracked on purpose,
# despite the generated-output patterns above.
!docs/samples/*.html

# Windows launcher settings. The example file is tracked; the real one is a
# local override, and tests/test-bat-contract.ps1 writes one here while it runs.
scripts/bomlens.settings.txt

# Test Workspace
tests/test-workspace/
test-workspace/
*.tar.gz
*.zip

# OS Files
.DS_Store
Thumbs.db
*.swp
*.swo
*~

# IDE Settings
.vscode/
.idea/
*.iml
*.sublime-project
*.sublime-workspace
.codesight/

# Log Files
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# Dependency Directories
node_modules/
venv/
.venv/
env/
.env/
__pycache__/
*.pyc
*.pyo
.pytest_cache/
.coverage
htmlcov/

# Java
target/
*.class
*.jar
*.war

# Build Artifacts
dist/
build/
!electron/build/
*.egg-info/
.gradle/

# Environment Variables
.env
.env.local
.env.*.local

# Temporary Files
tmp/
temp/
*.tmp

# Docker Build Cache
.docker/

# Backup Files
*.bak
*.orig

# Compressed Files (Excluding Releases)
release-assets/

# MkDocs build output (generated by `mkdocs build`)
site/

# Local agent tooling (kept on disk, not published)
.claude/
.claudeignore
CLAUDE.md
scripts/check-doc-style.sh

# Browser-automation scratch output. Accessibility snapshots of whatever pages
# were open, including vendor download portals, so it should never be staged.
.playwright-mcp/

# corpus run scratch
.corpus-work/
.corpus-baseline/
