.gitattributes

# Force LF for CSS files so PostCSS/Tailwind/Vite on Linux CI parse them
# correctly — CRLF in CSS can cause PostCSS to produce an "Unexpected }"
# parse error even when braces are balanced (Vite 6 + @tailwindcss/postcss 4).
*.css  text eol=lf
*.scss text eol=lf

# Force LF for Helm values/templates — the release workflow's GitOps bump step
# anchors on line content in deploy/helm/fuzefront/values-prod.yaml; a CRLF
# checkin once broke every release until the endings were manually restored.
# (Contents-API commits bypass gitattributes; the bump awk also tolerates \r.)
deploy/helm/** text eol=lf

# Force LF for the VENDORED FuzeInfra contract and its generated client.
# services/custom-hostname-api/openapi.yaml must stay byte-identical to the
# upstream file at the commit pinned in UPSTREAM.json -- CI diffs the two, and
# a CRLF checkin from a Windows dev made every line differ, failing the drift
# gate for a file nobody had actually changed. src/schema.ts is likewise
# regenerated on Linux CI and diffed, so it must be LF too.
services/custom-hostname-api/** text eol=lf
custom-hostname-client/**       text eol=lf

# CLAUDE.md had somehow accumulated CRLF endings before gate-line-endings
# existed to catch it; pin it to LF so touching it again doesn't retrip the
# gate on the file's pre-existing encoding.
CLAUDE.md text eol=lf

# Force LF for Dockerfiles and the npm/lerna manifests.
#
# gate-line-endings flags any file in a PR stored with CRLF, and these are the
# ones that keep arriving that way: they are edited on Windows, and unlike CSS
# or Helm the breakage is not visually obvious, so a CRLF manifest rides along
# in an unrelated PR and fails the gate for someone else. Covering the paths
# means git normalises on commit instead of the gate catching it after the fact.
#
# Dockerfiles specifically: the RUN lines are line-anchored by
# scripts/check-dockerfile-lockfile.mjs, and a stray \r is the classic way for a
# check like that to start reporting nonsense.
**/Dockerfile   text eol=lf
**/Dockerfile.* text eol=lf
package.json    text eol=lf
**/package.json text eol=lf
lerna.json      text eol=lf

# package-lock.json needs its own rule: the globs above match package.json
# only, never package-lock.json. npm rewrites a lockfile wholesale on every
# resolution, so a CRLF-stored lockfile regenerated on Linux comes back as LF
# and turns a handful of changed entries into a whole-file diff — which both
# hides the real change from review and trips gate-line-endings.
package-lock.json    text eol=lf
**/package-lock.json text eol=lf

# Same pre-existing-CRLF-before-gate-line-endings-existed story as CLAUDE.md
# above: these files were already stored as CRLF and tripped the gate the
# first time a PR touched them. Pin them to LF so it doesn't recur.
backend/security/src/services/authentikPassword.ts text eol=lf
backend/security/tests/authentik-password-login.test.ts text eol=lf
backend/src/routes/organizations.ts text eol=lf
backend/security/src/routes/security.ts text eol=lf
backend/security/src/providers/authentik/tenants.ts text eol=lf
backend/security/tests/tenant-registry.test.ts text eol=lf