fix(egress-audit): scan the files git sees, not generated ignored ones

Merged
EV
14d ago
+57-5

tools/egress-audit/static-hostnames.mjs says it scans "the files git tracks", but it walked the disk. CI's fresh checkout makes the two the same. A local checkout also holds the web app's generated packages/ui-config/src/lib/environments/environment.ts and environment.prod.ts, which are written from .env, git-ignored, and name Gauzy's hosts. So node --test tools/egress-audit/static-hostnames.test.mjs failed on every checkout where ui-config had been built, and every lane in this run had to move those files aside to check its change.

Change

  • The scan lists files with git ls-files -z --cached --others --exclude-standard: tracked files, plus new files git does not ignore, so a new file is still caught before it is committed.
  • The same dependency and build directories are skipped as before.
  • Outside a git work tree (the fixtures, a source archive) or without git, it walks the disk as before.
  • The scan is not loosened. On a clean checkout both lists are identical; on this worktree they differ only by the three ignored files (the two env files and .husky/_/husky.sh).

Tests

  • New case: a temporary git repository with a tracked file, a new file, an ignored file and a dist/ file. Only the first two are scanned.
  • node --test tools/egress-audit/static-hostnames.test.mjs: 8/8 pass, with the generated env files present. The old scanner failed on them.
  • Prettier clean.

cc @evereq

🤖 Generated with Claude Code

Summary by cubic

Fixes the egress audit scanner to use git's file list instead of walking the disk, so generated and git-ignored files no longer break local runs.

  • Lists files with git ls-files: tracked files plus new files git does not ignore, so new files are still caught before commit.
  • Falls back to walking the disk outside a git work tree.
  • Adds a test fixture of a temporary repo with tracked, new, ignored, and build-output files.