Git & GitHub・Your first commit

.gitignore — deciding what not to record

node_modules, .DS_Store, files with passwords in them — some things must never go into Git. Here's how to write .gitignore, and how to remove something you already committed by mistake.

Git will happily record anything in your folder. But some things must not be recorded, and others are pointless to record. The file that tells Git what to skip is .gitignore.

Three kinds of things to keep out

KindExamplesWhy
Things you can regeneratenode_modules/, build output foldersOne command rebuilds them, and they’re enormous
Things your OS creates.DS_Store (Mac), Thumbs.db (Windows)Local clutter that means nothing to anyone else
Things nobody should seeFiles with passwords or API keysOnce on GitHub, deleting them doesn’t remove them from history

That third one matters most. Assume that a password in a public repository will be found by a bot within minutes.

Creating the file

At the top level of your repository (next to index.html), create a file named .gitignore.

my-site/
├── .gitignore   ← the new file
├── images/
│   └── shima.png
├── index.html
├── script.js
└── style.css

Inside, list one thing to ignore per line.

# Files created by macOS and Windows
.DS_Store
Thumbs.db

# npm's parts bin
node_modules/

# Files containing keys
.env

Lines starting with # are comments and are ignored by Git. Noting why a line is there helps later.

Patterns you can write

PatternMeaning
.DS_StoreIgnore files with this name, at any level
node_modules/Ignore this folder and everything in it
*.logIgnore every file ending in .log (* means “anything”)
draft/memo.txtIgnore exactly this file in exactly this place
!important.logExclude from being ignored (! means “except this”)

You don’t need * and ! right away. Listing plain file and folder names covers most of what you need.

Check that it’s working

After writing .gitignore, run:

git status

If the rules apply, .DS_Store and node_modules/ have disappeared from the list. If they’re still there, check the spelling or whether the file is in the right place.

Removing something you already committed

This is the biggest trap. .gitignore only skips files Git isn’t already tracking, so it has no effect on files you’ve already recorded.

To untrack them:

git rm --cached .DS_Store
git commit -m "Stop tracking .DS_Store"

--cached means remove it from Git’s tracking but leave the actual file alone. For a whole folder, add -r (recursively):

git rm -r --cached node_modules

Summary of this lesson

  1. Anything listed in .gitignore stops being recorded by Git
  2. Keep out regenerable files, OS clutter, and secrets
  3. For already-recorded files, use git rm --cached — leave off --cached and you delete the real thing

FAQ

Do I always need a .gitignore file?
A small site of HTML and CSS works without one. But .DS_Store on Mac and node_modules from npm will creep in eventually, so adding one early is the safe move.
Why doesn't adding a file to .gitignore remove it?
Because .gitignore only tells Git to skip files it isn't already tracking. For files already recorded, use git rm --cached to untrack them, then commit.
What if I committed a password by accident?
Untracking the file doesn't remove it from history. If it reached GitHub, the reliable fix is to invalidate that password or API key and issue a new one.