4 · Initialize the repository

TL;DR

Objective — expand the bootstrap git from Create the project into the full import repo: merge Code & repository setup ignore rules, set identity, wire develop, and lock down per-directory storage ignores — without re-running git init if .git/ already exists.

User part + done-when

👤 User part — almost none: this page is entirely terminal-runnable. A person only needs to skim the .gitignore merge to confirm it keeps AI System bootstrap anchors (including /_source/ fully ignored and .vscode negation from C2 machine setup).

Done when the repo is on develop, git status shows no vendor/ / node_modules/ / .env, and every storage/** directory carries its own .gitignore.  ·  ⏱ ~15 min  ·  🤖 agent-runnable.

Background

The single most important ordering rule: .gitignore before the first commit that could track secrets or vendor/. Create the project already ran bootstrap git init, committed the pristine vendor baseline on author/v* + tag, and set develop — this page merges Code & repository setup patterns (remote prep, storage subtree, vault paths) without recreating the import. If you somehow skipped Create the project, write .gitignore first, then git init, then run pristine baseline commit before continuing.

Steps

1. Set session variables

Export your project’s values once so every command here (and on the next pages) is copy-paste safe. Pull them from your ProjectCard.

1. Export the project variables.

   export PROJECT_NAME="<project>"
   export VERSION="x.y.z"                                   # replace with the vendor's semver
   export GITHUB_REPO="git@github.com:<your-org>/<project>.git"
   export GIT_USERNAME="Your Name"
   export GIT_EMAIL="<you>@users.noreply.github.com"
   echo "Project: $PROJECT_NAME · Version: $VERSION · Repo: $GITHUB_REPO"
   # Expected: the echoed line shows your real project / version / repo values

   • ✅ The echo prints your actual project, version, and repo — no <placeholder> left.

2. Merge .gitignore (bootstrap → Code & repository setup)

If Create the project ran, keep its anchored patterns (/vendor/, /_source/, !.env.tpl when using 1Password, .vscode negation from C2). Add or reconcile the lines below — do not replace the whole file blindly. The bootstrap block lives on Create the project §4; this page only adds Phase-2 deltas.

Write or merge the ignore file so the very next git status stays clean.

flowchart LR
  A[".gitignore<br/>merged / written"] --> B{"git init<br/>already?"}
  B -->|no| C["git init"]
  B -->|yes| D["skip init"]
  C --> E["git branch -M develop"]
  D --> E
  E --> F["git config<br/>user.name / user.email"]

1. Write a baseline .gitignore for a CodeCanyon Laravel app.

   .gitignore

   # Dependencies
   /vendor/
   /node_modules/
   
   # Secrets (never commit)
   .env
   .env.*
   !.env.example
   !.env.tpl
   
   # Laravel generated
   /storage/*.key
   /bootstrap/cache/*.php
   
   # Archive — NEVER in git (AI System bootstrap)
   /_source/
   
   # OS & IDE — .vscode/*.json committed at C2 (machine setup); keep negation if present
   .DS_Store
   /.idea/
   /.vscode/*
   !/.vscode/extensions.json
   !/.vscode/settings.json
   !/.vscode/launch.json
   
   # Logs & testing
   *.log
   .phpunit.result.cache
   
   # CodeCanyon ZIPs
   *.zip
   
   # Agent/browser automation state (can contain cookies, auth headers, PII)
   /.playwright-mcp/*
   !/.playwright-mcp/.gitkeep
   /.browser-mcp/
   /test-results/
   /playwright-report/
   
   # Build — comment out the next line if you use the Build-Locally strategy
   # /public/build/
   
   # Project vault (credentials)
   /Admin-Local/1-Project/2-ProjectVault/

   • ✅ .gitignore exists at the repo root before any git command runs.

2. Keep the Playwright MCP folder present but empty.

   mkdir -p .playwright-mcp
   touch .playwright-mcp/.gitkeep
   git check-ignore .playwright-mcp/session.json && echo "✅ browser state ignored"
   # Expected: ✅ browser state ignored

   • ✅ Only .playwright-mcp/.gitkeep is eligible for git; generated browser state is ignored.

Keep lock files tracked

Never add composer.lock or package-lock.json to .gitignore — committing locked dependency versions is what makes every clone reproducible.

You ignore vendor/ so it never bloats history — but you do not delete the shipped tree (see Extract & snapshot).

vendor/ is ignored but still sacred

Ignored ≠ deletable. The author’s patched packages stay on disk until local development verifies the app runs.

3. Initialize or confirm git on develop

1. Init only if needed, confirm develop, set identity — do not delete author/v* branches.

   if [ ! -d .git ]; then git init; fi
   git branch --show-current    # expect develop after AI System setup
   git branch -M develop 2>/dev/null || true   # no-op if already develop
   git config user.name  "$GIT_USERNAME"
   git config user.email "$GIT_EMAIL"
   git branch --list 'author/*'
   # Expected: develop current; author/vX.X.X still present from Create the project baseline

   • ✅ git branch --show-current prints develop; author/v* branch still listed; user.name/user.email are set.

develop and the frozen author/vX.X.X baseline already exist from AI System setup. Commit & freeze pushes them — it does not recreate the import commit.

4. Lock down storage ignores

Laravel’s storage/ subtree must keep its folders in git but ignore their contents. Backfill any missing per-directory .gitignores.

1. Backfill the per-directory storage ignores.

   for dir in storage/app storage/app/public storage/framework \
     storage/framework/cache storage/framework/sessions \
     storage/framework/views storage/logs; do
     [ -f "$dir/.gitignore" ] || { mkdir -p "$dir"; printf "*\n!.gitignore\n" > "$dir/.gitignore"; }
   done
   # Expected: each storage subdir ends up with a "* / !.gitignore" ignore file

   • ✅ Every storage/** directory carries a .gitignore.

2. Confirm the root ignore catches the big three before you stage anything.

   grep -E "^/vendor|^/node_modules|^\.env$" .gitignore   # all three should print
   # Expected: three matching lines (/vendor, /node_modules, .env)

   • ✅ All three patterns print, and git status shows no vendor/, node_modules/, or .env.

3. Prove lock files are not ignored.

   for f in composer.lock package-lock.json pnpm-lock.yaml yarn.lock; do
     test -e "$f" || continue
     git check-ignore -q "$f" && echo "❌ ignored: $f" || echo "✅ tracked-capable: $f"
   done
   # Expected: every existing lock file is tracked-capable

   • ✅ Lock files remain commit-capable so dependency versions are reproducible.

4. Match /public/build to the chosen asset strategy.

   if grep -q '^/public/build/' .gitignore; then
     echo "Strategy: build-on-server or CI artifact upload"
   else
     test -f public/build/manifest.json && echo "Strategy: build locally and commit public/build"
   fi
   # Expected: the printed strategy matches your deploy plan

   • ✅ .gitignore and the deploy asset strategy agree.

Checklist

Do not mark this step done until every box below is checked.

• 🤖 Session variables exported — PROJECT_NAME, VERSION, GITHUB_REPO, identity.
• 🤖 .gitignore merged — AI System bootstrap anchors preserved; Code & repository setup patterns added; lock files not ignored.
• 🤖 Tree clean — git status shows no vendor/, node_modules/, or .env.
• 🤖 On develop — user.name / user.email configured.
• 🤖 Storage ignores in place — each storage/** directory carries a .gitignore.

→Next step

Wire .env templates