occam-gitignore

Deterministic, content-addressed .gitignore generator. Given the same project tree, always produces the same output, byte-for-byte, with a provenance_hash header so any third party can verify the result was generated by an honest implementation of the algorithm.

pipx install occam-gitignore
occam-gitignore apply /path/to/repo      # merge into .gitignore, keeping your own lines
occam-gitignore generate /path/to/repo   # preview the canonical output on stdout

Why deterministic?

A .gitignore is part of your repo's reproducible build surface. If two checkouts of the same commit produce different ignore files, your CI is lying. occam-gitignore fingerprints the project tree, runs a pure function over a content-addressed templates table + a versioned mined-rules table, and emits an ignore file annotated with hashes of every input. No I/O ordering, no clock, no hostname.

Guarantees

• Determinism: identical inputs ⇒ identical bytes (UTF-8, LF, single trailing newline). Property-tested with Hypothesis (P1–P7) and validated by a 32-case conformance suite that any external implementation can run.
• Content addressing: templates and rules table carry sha256:<12-hex> versions; mismatched declarations are rejected at load time.
• Provenance: every emitted .gitignore includes a header with the full provenance_hash (Merkle of core + templates + rules_table + content) so drift is one grep away.
• Supply chain: every release ships with an SPDX SBOM and a SLSA Level 3 build provenance attestation.

Links

• Source: https://github.com/fabriziosalmi/gitignore
• Conformance spec: see conformance/SPEC.md
• Algorithm reference: pure Python in occam-gitignore-core

MIT licensed.