.gitignore not working? Git is still tracking the file

.gitignore only stops untracked files from being added. If git already tracks a file, adding it to .gitignore changes nothing until you untrack it.

1. The file was committed before you ignored it (most common)

# stop tracking it, keep it on disk
git rm --cached .env
# a whole folder
git rm -r --cached node_modules
git commit -m "Stop tracking ignored files"

After this commit the file stays on your machine and git leaves it alone. Teammates who pull will have it deleted from their working copy, so warn them to back it up first if it holds local config.

2. Re-apply .gitignore to the whole repo

When many files slipped in before the rules existed:

git rm -r --cached .
git add .
git status   # check only the files you expect are now deleted from the index
git commit -m "Apply .gitignore"

Read git status before committing. This is the step where a stray .env or key file gets picked up again if your rules are wrong.

3. Check which rule (if any) matches

git check-ignore -v path/to/file
# prints the .gitignore file, line number and pattern that matched
# prints nothing = no rule ignores it

4. Common pattern mistakes

/build only matches at the repo root; build/ matches any folder named build.
Trailing spaces in a pattern break it. So does saving .gitignore as UTF-16 (some Windows editors do).
The file is named .gitignore.txt or sits in the wrong folder. Patterns are relative to the .gitignore that holds them.
A later !pattern line re-includes what an earlier line ignored. Order matters.
You can't re-include a file if its parent folder is ignored: ignore logs/*, not logs/, then !logs/keep.txt.

5. Ignore a tracked file only on your machine

git update-index --skip-worktree config/local.json
# undo:
git update-index --no-skip-worktree config/local.json

Use this for local edits to a shared config, never for secrets. A secret that was ever committed is in history: see I committed my .env to GitHub.

Catch it at git add, not after

KatchPath warns when a .env, key file or node_modules is about to be staged, even if your .gitignore is wrong. Free, runs locally:

curl -fsSL https://katchpath.com/install.sh | sh
katchpath install