`adk deploy cloud_run` and `adk deploy gke` copied the whole agent folder
into the staging directory with no exclusions at all, so a `.env` holding
a live API key was built into the container image and its registry layers
even when the user's own `.gitignore` excluded it. `adk deploy
agent_engine` filtered on `.ae_ignore` alone, and read it without
stripping comments or normalizing trailing slashes.
A single `_get_ignore_patterns_func` now unions the patterns from
`.gitignore`, `.gcloudignore` and `.ae_ignore`, normalizes them for
`fnmatch`, and feeds all three `copytree` calls. The local dev UI's
`.adk` folder is excluded unconditionally, because the session database
it holds grows large enough to fail a deployment. Nothing else is
excluded on the user's behalf, so a `.git` directory is still copied
unless an ignore file lists it.
Ports commits ee79e712 ("respect ignore files in adk deploy commands",
PR #4187) and dab351be ("Prevent adk deploy from uploading
.adk/session.db") from main.
The second of those writes `patterns = set('.adk/')`, which iterates the
string into five one-character patterns, so `.adk` is not excluded on
main either and a file named `d` is. This port writes `{'.adk'}`.
Behaviour change: files matched by an ignore file are no longer
deployed. A deployment that relied on a `.env` excluded by `.gitignore`
reaching Cloud Run must now supply those values as environment variables
or secrets on the target.
George Weale
8b978b646c