# Deny-by-default build context (US08-02): the image must contain no secrets, no # photos, no database, no logs, and no .git. An allow list is the only version of this # rule that stays true when a new file appears in the working copy. * !pyproject.toml !alembic.ini !README.md !photo_pipeline !migrations !frontend !docker # Nothing generated, even under an allowed directory. **/__pycache__ **/*.py[cod] **/.DS_Store **/*.env **/*.log **/*.db **/*.db-* **/*.sqlite*