terraform: fileset does not respect gitignore

♠ Problem statement: a terraform project planned clean locally (terraform plan), but CI insisted on a diff. Every apply fixed it for one side and broke it for the other, back-and-forth. The culprit was a null_resource that rebuilds an AWS Lambda for a NodeJS app bundle whenever its sources change, keyed on a hash of the whole directory: resource "null_resource" "lambda_build" { triggers = { dir_sha = sha256(join("", [for f in sort(fileset("${path.module}/lambda", "**")) : "${f}:${filesha256("${path.module}/lambda/${f}")}"])) } provisioner "local-exec" { command = "cd ${path.module}/lambda && npm ci && npm run build" } } fileset() walks the filesystem. It has no idea .gitignore exists. So node_modules/ and dist/, present locally after a build, but absent in a fresh CI checkout, creates the discrepancy. A minimal reproduction test case, with node_modules/ and dist/ gitignored: % git ls-files lambda | wc -l 2 % echo 'sha256(join("", [for f in sort(fileset("./lambda", "**")) :…