Exclude files

gspot reads the files that Git tracks, and untracked files that .gitignore does not hide. Keep build output and other files that do not belong in Git in .gitignore. Most checks read only your own source files. Secret scans read every file, and dependency checks read lockfiles.

Files gspot leaves out

gspot leaves these out of most checks without a mark:

• generator output: files whose first lines carry a generator banner, such as @generated or // Code generated by ... DO NOT EDIT.
• vendored files: files under a folder named vendor, third_party, third-party, node_modules, Pods, Carthage, or .build, and license files
• binary files

Run gspot explain ./<path> to see how gspot treats a file.

Mark other files

In .gitattributes, mark other generator output as linguist-generated, and other vendored files as linguist-vendored:

src/api/schema.ts linguist-generated
lib/upstream/** linguist-vendored

Leave a file out of one check

Ignore the check for those paths, with a reason:

gspot ignore javascript/eslint --paths "scripts/**" --reason "Scripts print their results."

See Ignore findings.