All 15 Git & Project Management questions
More in Git & Project Management
What is the purpose of a package-lock.json file in a Node.js project, and why should it be committed to version control? What is the purpose of a CHANGELOG.md file in a Node.js project, and what should typically be included in each entry? What is a monorepo, and what specific tooling (like npm workspaces or Turborepo) helps manage multiple related Node.js packages within a single repository? What is semantic versioning (semver), and how does it inform how a Node.js package's version number should change between releases? How would you set up branch protection rules and required status checks for a Node.js repository to prevent broken code from being merged? What is the difference between npm, Yarn, and pnpm as Node.js package managers, and what specific advantage does pnpm offer regarding disk space? What is a pull request template, and how does it help standardize code review in a Node.js team's Git workflow? What is the purpose of an npm 'scripts' section in package.json, and how do custom scripts standardize common project tasks across a team? How would you use Git hooks (like a pre-commit hook via Husky) to enforce code quality checks before code is committed in a Node.js project? How would you structure conventional commit messages in a Node.js project, and how do they enable automated changelog generation?
Advertisement
Back to results for “Security”
Node.js › Git & Project Management

What is the purpose of a .gitignore file in a Node.js project, and what should always be included in it?

Beginner

Answer

.gitignore tells Git which files and directories to never track or commit -- for a Node.js project this critically includes node_modules (which should always be reinstalled from package-lock.json rather than committed, given its size and platform-specific native binaries), .env files containing secrets, build output directories, and log files, keeping the repository focused on source code and configuration rather than generated or sensitive artifacts.
# .gitignore
node_modules/
.env
.env.local
dist/
*.log
coverage/
Real-world example A new contributor accidentally committed their local .env file containing real API keys to a public repository before the team had a proper .gitignore in place, requiring the keys to be rotated immediately and prompting the team to add a comprehensive .gitignore to prevent recurrence.

Common follow-ups: What's the correct process for removing a sensitive file from Git history after it's already been committed and pushed?;Why shouldn't node_modules ever be committed, even though it would technically make cloning and running the project 'simpler'?

Security;npm & Packages
All 15 Git & Project Management questions