[DaveHanns]

Summary

apify push picked the wrong files in a few gitignore cases. The worst case: an Actor in an ignored directory uploaded everything, including files its own .gitignore lists, such as a .env. This fixes the five cases from #1536. Actor discovery for apify push --all uses the same helper, so it marks ignored Actors the same way.

Changes

• With git, the helper reads git ls-files -z and matches the listed paths exactly. A path is ignored when git lists it or it lies under a listed entry. That also covers an ignored symlink to a directory, which git lists without a trailing slash. Names are compared in NFC, so names with non-ASCII characters (in either Unicode form) and names like #hash.txt or [ab].js now match.
• When the rules ignore the pushed directory itself, or git fails, the helper reads the rules itself. git check-ignore --no-index answers whether the directory is ignored, whatever is tracked in it. The helper then applies every .gitignore inside the directory, every one above it up to and including the repository root, and .git/info/exclude and the global excludes file when git names them. In the files above, the lines that ignore the pushed directory are dropped, since pushing it is explicit. Their other lines still apply.
• These rules rank as they do in git. A deeper .gitignore wins over a shallower one, so its ! lines re-include files. Every .gitignore wins over .git/info/exclude, which wins over the global excludes file. A file below an ignored directory stays ignored. All lines go into one ignore instance, rewritten to match paths from the repository root.
• Without git, the walk now reads the repository root .gitignore too. It still stops there, so an outer repository's rules don't apply. When the pushed directory is the repository root, the walk no longer reads the .gitignore files above it.
• Actor discovery passes the Actor directories it found to the helper, which asks git check-ignore about them. An ignored Actor directory that holds a tracked file is now marked ignored.
• .actorignore works as before, including its ! lines that force-include gitignored files.

Tests

• One test per case, each failing on the old code: the repository root .gitignore without git, non-ASCII names in both forms, names that look like patterns, an ignored symlink to a directory, a pushed directory that is itself ignored (with and without git, and with a tracked file in it), and a deeper ! line (with and without git).
• .actorignore force-includes with directories and files git lists, and in an ignored directory.
• The no-git tests create a fake .git, so the apify-cli .gitignore no longer applies to them.

Notes for reviewers

• Stacked on feat: let apify push select which Actors to push in a repository with several #1504. It'll be retargeted to master after feat: let apify push select which Actors to push in a repository with several #1504 merges.
• .git/info/exclude and the global excludes file are applied in the ignored-directory path, so the only rules left out are the lines that ignore the pushed directory. Without git, they're skipped as before.
• Lines are dropped only from a file whose rules ignore the pushed directory. A whitelist like * with !*/ doesn't ignore directories, so it stays whole.
• A subdirectory of an ignored directory counts as ignored too, so it takes the same path. git ls-files fails there anyway (git 2.39 reports an internal error).
• The rules path doesn't know which files are tracked. In an ignored directory, a tracked file that a rule matches is left out. Outside one, git mode keeps tracked files as before.
• Exact matching is a bit stricter than the old pattern matching: a name git lists in one place no longer excludes a tracked file with the same name elsewhere.
• Each push and each discovery runs one more git command, git check-ignore.

Closes #1536

🤖 Generated with Claude Code