apify push uploads some gitignored files #1536

Problem

apify push leaves out the files that .gitignore rules exclude. It asks git ls-files which files are ignored. When git fails (not installed, not a repository, or git refuses to run), it reads the .gitignore files itself. In five cases, it picks the wrong files:

1. An Actor in an ignored directory uploads everything, secrets included. When the pushed directory is itself ignored (for example, ghost/ in the root .gitignore), git prints only ./, which matches no file. Every file is uploaded, including a .env that the Actor's own .gitignore lists and files that root rules like *.log exclude. git can't re-include files under an ignored directory, so it can't say which files the directory's own rules exclude. When the ignored directory holds a tracked file, git lists its untracked files one by one instead, and the push leaves out the Actor's own files, such as main.js.
2. Without git, a push from a subdirectory skips the repository root .gitignore. The fallback stops at the directory that holds .git before it reads that directory's .gitignore. Pushing actors/a uploads files the root .gitignore excludes, such as x.log or root-ignored/f.txt.
3. Names with non-ASCII characters never match. git prints them quoted and escaped (příliš.log comes out as "p\305\231..."), so the ignored file is uploaded. On macOS, git also prints names in composed form (NFC), so a name stored in decomposed form (NFD) doesn't match either.
4. Names are read as patterns. Each name git prints goes to the ignore matcher as a pattern. An ignored #hash.txt turns into a comment and is uploaded. A name like [ab].js or * also matches other files.
5. Without git, a deeper .gitignore can't re-include a file. The fallback leaves a file out when any one .gitignore ignores it. In git, the ! lines of a deeper .gitignore win. With *.log in the root .gitignore and !keep.log in sub/.gitignore, git keeps sub/keep.log, but the fallback leaves it out.

Actor discovery for apify push --all uses the same check to mark Actors in ignored directories, so it has the same gaps. For example, it marks an ignored directory that holds a tracked file as not ignored.

What we want

• apify push leaves out every file that .gitignore rules exclude, whatever its name, and keeps the files a deeper ! line re-includes.
• Pushing a directory that is itself ignored still applies every other rule: the .gitignore files inside it, and the rules above it that don't ignore the directory itself. Tracked files in the directory don't change that.
• Without git, the repository root .gitignore applies too, and the rules rank as they do in git. Rules of an outer repository still don't apply.
• .actorignore works as today, including its ! lines that force-include gitignored files.

How it's tested

Unit tests in the utils test files, one per case, each failing on the current code. Plus tests that .actorignore force-includes still work with git and in an ignored directory.

Links

• chore: swap globby with tinyglobby #1017: where the git ls-files version came in.
• feat: let apify push select which Actors to push in a repository with several #1504: Actor discovery for apify push --all uses the same check to mark ignored Actors.