chore: gitignore .npmrc so a registry token can't be committed

Publishing to the Gitea npm registry needs an _authToken, and the natural place to put it is a .npmrc in the repo root — which was not ignored. The committed .npmrc.example invites exactly that mistake. The pattern matches the exact filename, so .npmrc.example is unaffected. Nothing was leaked: no .npmrc has ever been committed here. This is preventative. Better still, publish with `npm publish --userconfig <path outside the repo>` and keep the token out of the working tree entirely — that is how v0.5.0 was published. Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-07 15:00:35 -05:00
parent 840504843a
commit 10a29ded6a
1 changed files with 7 additions and 0 deletions
@@ -14,3 +14,10 @@ dist-demo/

 # tsup temp (mount cannot unlink)
 tsup.config.bundled_*.mjs
+
+# A real .npmrc carries the Gitea registry _authToken — never commit it.
+# This pattern matches the exact filename only, so .npmrc.example (which is
+# meant to be committed) is unaffected.
+# Publishing from a clone: prefer `npm publish --userconfig <path outside the
+# repo>` over writing a token into the working tree at all.
+.npmrc