Validates negated export-ignore directives

raphaelstolt · raphaelstolt · commit 1bbafa7a0b2e · 2026-05-18T02:16:54.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
 
 ## [Unreleased]
 
+## [v5.10.0] - 2026-05-18
+
+### Added
+- Expanded the `validation` to also validate __negated__ export-ignore directives. Closes [#70](https://github.com/raphaelstolt/lean-package-validator/issues/70).
+
 ## [v5.9.1] - 2026-05-17
 
 ### Changed
diff --git a/README.md b/README.md
@@ -73,8 +73,11 @@ brew install lean-package-validator
 
 Run the lean package validator CLI within or against a project/micro-package
 directory, and it will validate the [export-ignore](https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#Exporting-Your-Repository) entries present in
-a `.gitattributes` file against a set of common repository artefacts. If no
-`.gitattributes` file is present it will suggest creating one.
+a `.gitattributes` file against a set of common repository artefacts.
+
+It can handle __"normal"__ export-ignore directives as well as __negated__ export-ignore directives.
+
+If no `.gitattributes` file is present it will suggest creating one.
 
 ``` bash
 lean-package-validator validate [<directory>]
diff --git a/src/Analyser.php b/src/Analyser.php
@@ -668,7 +668,7 @@ public function getPresentExportIgnoresToPreserve(array $globPatternMatchingExpo
             &$globPatternMatchingExportIgnores,
             &$basenamedGlobPatternMatchingExportIgnores
         ) {
-            if (\strstr($line, 'export-ignore') && \strpos($line, '#') === false) {
+            if (\strstr($line, 'export-ignore') && !\str_contains($line, '-export-ignore') && \strpos($line, '#') === false) {
                 list($pattern, $void) = \explode('export-ignore', $line);
                 if (\substr($pattern, 0, 1) === '/') {
                     $pattern = \substr($pattern, 1);
@@ -1164,7 +1164,8 @@ public function getPresentExportIgnores(bool $applyGlob = true, string $gitattri
 
         $exportIgnores = [];
         \array_filter($gitattributesLines, function (string $line) use (&$exportIgnores, &$applyGlob) {
-            if (\strstr($line, 'export-ignore', true)) {
+            $before = \strstr($line, 'export-ignore', true);
+            if ($before !== false && $before !== '' && !\str_ends_with(\rtrim((string) $before), '-')) {
                 list($line, $void) = \explode('export-ignore', $line);
                 if ($applyGlob) {
                     if ($this->patternHasMatch(\trim($line))) {
@@ -1231,8 +1232,112 @@ private function getByDirectoriesToFilesExportIgnoreArtifacts(array $artifacts):
         return \array_merge($directories, $files);
     }
 
+    public function usesNegatedExportIgnoreStrategy(string $gitattributesContent = ''): bool
+    {
+        if ($gitattributesContent === '') {
+            if ($this->hasGitattributesFile() === false) {
+                return false;
+            }
+            $gitattributesContent = (string) \file_get_contents($this->gitattributesFile);
+        }
+
+        $lines = \preg_split('/\\r\\n|\\r|\\n/', $gitattributesContent) ?: [];
+
+        foreach ($lines as $line) {
+            if (\trim($line) === '* export-ignore') {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @param bool $applyGlob
+     * @param string $gitattributesContent
+     * @return array<int, string>
+     */
+    public function getPresentNegatedExportIgnores(bool $applyGlob = true, string $gitattributesContent = ''): array
+    {
+        if ($this->hasGitattributesFile() === false && $gitattributesContent === '') {
+            return [];
+        }
+
+        if ($gitattributesContent === '') {
+            $gitattributesContent = (string) \file_get_contents($this->gitattributesFile);
+        }
+
+        $lines = \preg_split('/\\r\\n|\\r|\\n/', $gitattributesContent) ?: [];
+
+        $negatedIgnores = [];
+
+        foreach ($lines as $line) {
+            if (!\str_contains($line, '-export-ignore') || \str_starts_with(\ltrim($line), '#')) {
+                continue;
+            }
+
+            [$pattern] = \explode('-export-ignore', $line, 2);
+            $pattern = \ltrim(\trim($pattern), '/');
+
+            if ($pattern === '') {
+                continue;
+            }
+
+            if ($applyGlob) {
+                if ($this->patternHasMatch($pattern)) {
+                    $negatedIgnores[] = $pattern;
+                }
+            } else {
+                $negatedIgnores[] = $pattern;
+            }
+        }
+
+        if ($this->isStrictOrderComparisonEnabled() === false) {
+            \sort($negatedIgnores, SORT_STRING | SORT_FLAG_CASE);
+        }
+
+        return \array_unique($negatedIgnores);
+    }
+
+    public function hasCompleteNegatedExportIgnores(): bool
+    {
+        if ($this->hasGitattributesFile() === false) {
+            return false;
+        }
+
+        if ($this->usesNegatedExportIgnoreStrategy() === false) {
+            return false;
+        }
+
+        $content = (string) \file_get_contents($this->gitattributesFile);
+
+        if (\preg_match("/(\*\h*)(text\h*)(=\h*auto)/", $content)) {
+            $this->hasTextAutoConfiguration = true;
+        }
+
+        $matchingNegatedIgnores = $this->getPresentNegatedExportIgnores(true);
+
+        if ($matchingNegatedIgnores === []) {
+            return false;
+        }
+
+        if ($this->isStaleExportIgnoresComparisonEnabled()) {
+            $allNegatedIgnores = $this->getPresentNegatedExportIgnores(false);
+            $staleNegatedIgnores = \array_diff($allNegatedIgnores, $matchingNegatedIgnores);
+            if ($staleNegatedIgnores !== []) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     public function hasCompleteExportIgnoresFromString(string $gitattributesContent): bool
     {
+        if ($this->usesNegatedExportIgnoreStrategy($gitattributesContent)) {
+            return $this->getPresentNegatedExportIgnores(true, $gitattributesContent) !== [];
+        }
+
         $expectedExportIgnores = $this->collectExpectedExportIgnores();
         $presentExportIgnores = $this->getPresentExportIgnores(true, $gitattributesContent);
 
@@ -1245,6 +1350,10 @@ public function hasCompleteExportIgnoresFromString(string $gitattributesContent)
      */
     public function hasCompleteExportIgnores(): bool
     {
+        if ($this->usesNegatedExportIgnoreStrategy()) {
+            return $this->hasCompleteNegatedExportIgnores();
+        }
+
         $expectedExportIgnores = $this->collectExpectedExportIgnores();
 
         if ($expectedExportIgnores === [] || $this->hasGitattributesFile() === false) {
diff --git a/src/Commands/ValidateCommand.php b/src/Commands/ValidateCommand.php
@@ -587,6 +587,17 @@ protected function execute(InputInterface $input, OutputInterface $output): int
             $output->writeln($verboseOutput, OutputInterface::VERBOSITY_VERBOSE);
 
             if ($this->analyser->hasCompleteExportIgnores() === false) {
+                if ($this->analyser->usesNegatedExportIgnoreStrategy()) {
+                    $message = 'The present .gitattributes file is considered <error>invalid</error>: '
+                        . 'It uses the negated export-ignore strategy but has no or only stale -export-ignore re-inclusions.';
+                    if ($isAgenticRun) {
+                        $this->writeAgenticOutput($output, $this->getName(), false, \strip_tags($message), ['valid' => false]);
+                    } else {
+                        $output->writeln($message);
+                    }
+                    return Command::FAILURE;
+                }
+
                 $verboseOutput = "+ Gathering expected .gitattribute content.";
                 $output->writeln($verboseOutput, OutputInterface::VERBOSITY_VERBOSE);
 
diff --git a/tests/Commands/ValidateCommandTest.php b/tests/Commands/ValidateCommandTest.php
@@ -2558,4 +2558,128 @@ public function outputsJsonOnMissingGitattributesFileWhenAgenticRunOptionIsSet()
         $this->assertFalse($json['valid']);
         $this->assertArrayHasKey('expected_gitattributes_content', $json);
     }
+
+    #[Test]
+    public function validatesNegatedExportIgnoreDirectivesAsValid(): void
+    {
+        $this->createTemporaryFiles(['composer.json', 'LICENSE.md'], ['src', 'bin']);
+
+        $gitattributesContent = <<<CONTENT
+# Line-ending normalization for text files.
+* text=auto
+
+# PHP-aware hunk headers in `git diff`.
+*.php diff=php
+
+# Binary files keep their bytes.
+*.gpg binary
+*.phar binary
+
+# Default: nothing is included in the dist archive of the Composer package.
+# Re-include only the files that actually belong to the distributed package below.
+* export-ignore
+
+# Top-level metadata.
+composer.json -export-ignore
+LICENSE.md -export-ignore
+
+# Source code and CLI entry point.
+/src           -export-ignore
+/bin           -export-ignore
+CONTENT;
+
+        $this->createTemporaryGitattributesFile($gitattributesContent);
+
+        $command = $this->application->find('validate');
+
+        TestCommand::for($command)
+            ->addArgument(WORKING_DIRECTORY)
+            ->execute()
+            ->assertOutputContains('The present .gitattributes file is considered valid.')
+            ->assertSuccessful();
+    }
+
+    #[Test]
+    public function validatesIncompleteNegatedExportIgnoreDirectivesAsInvalid(): void
+    {
+        $this->createTemporaryFiles(['composer.json'], ['src']);
+
+        $gitattributesContent = <<<CONTENT
+# Default: nothing is included in the dist archive of the Composer package.
+* export-ignore
+CONTENT;
+
+        $this->createTemporaryGitattributesFile($gitattributesContent);
+
+        $command = $this->application->find('validate');
+
+        TestCommand::for($command)
+            ->addArgument(WORKING_DIRECTORY)
+            ->execute()
+            ->assertOutputContains('It uses the negated export-ignore strategy but has no or only stale -export-ignore re-inclusions.')
+            ->assertFaulty();
+    }
+
+    #[Test]
+    #[RunInSeparateProcess]
+    public function validatesNegatedExportIgnoreDirectivesFromStdinAsValid(): void
+    {
+        $this->createTemporaryFiles(['composer.json', 'LICENSE.md'], ['src']);
+
+        $gitattributesContent = <<<CONTENT
+* export-ignore
+
+/composer.json -export-ignore
+/LICENSE.md    -export-ignore
+/src           -export-ignore
+CONTENT;
+
+        $this->createTemporaryGitattributesFile($gitattributesContent);
+
+        $application = new Application();
+        $fakeInputReader = new FakeInputReader();
+        $fakeInputReader->set($gitattributesContent);
+
+        $analyserCommand = new ValidateCommand(
+            new Analyser(new Finder(new PhpPreset())),
+            new Validator(new Archive($this->temporaryDirectory)),
+            $fakeInputReader
+        );
+
+        $application->addCommand($analyserCommand);
+        $command = $application->find('validate');
+
+        TestCommand::for($command)
+            ->addOption('stdin-input')
+            ->execute()
+            ->assertOutputContains('The provided .gitattributes content is considered valid.')
+            ->assertSuccessful();
+    }
+
+    #[Test]
+    public function detectsStaleNegatedExportIgnoreDirectivesAsInvalid(): void
+    {
+        $this->createTemporaryFiles(['composer.json', 'LICENSE.md'], ['src']);
+
+        $gitattributesContent = <<<CONTENT
+* export-ignore
+
+composer.json      -export-ignore
+LICENSE.md         -export-ignore
+NON_EXISTENT.md    -export-ignore
+/src               -export-ignore
+/stale-non-existent-dir -export-ignore
+CONTENT;
+
+        $this->createTemporaryGitattributesFile($gitattributesContent);
+
+        $command = $this->application->find('validate');
+
+        TestCommand::for($command)
+            ->addArgument(WORKING_DIRECTORY)
+            ->addOption('report-stale-export-ignores')
+            ->execute()
+            ->assertOutputContains('It uses the negated export-ignore strategy but has no or only stale -export-ignore re-inclusions.')
+            ->assertFaulty();
+    }
 }
