feat: check .gitignore covers common sensitive files

internal/check/gitignore.go

@@ -0,0 +1,86 @@
+package check
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"strings"
+)
+
+type requiredPattern struct {
+	pattern     string
+	description string
+}
+
+type GitignoreCheck struct {
+	Dir      string
+	Patterns []requiredPattern
+}
+
+func (c *GitignoreCheck) Name() string {
+	return ".gitignore covers sensitive files"
+}
+
+func (c *GitignoreCheck) Run(_ context.Context) Result {
+	gitignorePath := c.Dir + "/.gitignore"
+
+	// Read .gitignore content
+	file, err := os.Open(gitignorePath)
+	if err != nil {
+		return Result{
+			Name:    c.Name(),
+			Status:  StatusFail,
+			Message: ".gitignore not found",
+			Fix:     "Create a .gitignore file with common patterns",
+		}
+	}
+	defer file.Close()
+
+	// Parse .gitignore and collect all patterns
+	patterns := make(map[string]bool)
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		// Skip comments and empty lines
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		patterns[line] = true
+	}
+
+	// Check which patterns are missing
+	var missing []string
+	for _, rp := range c.Patterns {
+		// Check if pattern or a variant exists
+		found := false
+		for existingPattern := range patterns {
+			// Match exact pattern or with trailing slash (for directories)
+			if existingPattern == rp.pattern ||
+				existingPattern == rp.pattern+"/" ||
+				existingPattern == "**/"+rp.pattern ||
+				existingPattern == "**/"+rp.pattern+"/" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			missing = append(missing, fmt.Sprintf("%s (%s)", rp.pattern, rp.description))
+		}
+	}
+
+	if len(missing) > 0 {
+		return Result{
+			Name:    c.Name(),
+			Status:  StatusWarn,
+			Message: fmt.Sprintf("Missing %d sensitive file patterns", len(missing)),
+			Fix:     fmt.Sprintf("Add these patterns to .gitignore:\n  %s", strings.Join(missing, "\n  ")),
+		}
+	}
+
+	return Result{
+		Name:    c.Name(),
+		Status:  StatusPass,
+		Message: "Common sensitive files are gitignored",
+	}
+}

internal/check/registry.go

@@ -86,6 +86,28 @@ func Build(stack detector.DetectedStack) []Check {
 		cs = append(cs, &EnvCheck{Dir: "."})
 	}
 
+
+	// Check .gitignore for sensitive file patterns
+	if fileExists(".gitignore") {
+		gitignorePatterns := []requiredPattern{
+			{pattern: ".env", description: "Environment files with secrets"},
+			{pattern: "*.log", description: "Log files"},
+		}
+		if stack.Node {
+			gitignorePatterns = append(gitignorePatterns, requiredPattern{
+				pattern:     "node_modules",
+				description: "Node.js dependencies",
+			})
+		}
+		if stack.Python {
+			gitignorePatterns = append(gitignorePatterns, requiredPattern{
+				pattern:     "__pycache__",
+				description: "Python cache",
+			})
+		}
+		cs = append(cs, &GitignoreCheck{Dir: ".", Patterns: gitignorePatterns})
+	}
+
 	return cs
 }