fix(core): negated gitignore patterns inside subdirectories are not including matched files (#35511)

### Issue # (if applicable)

Closes #9146

### Reason for this change

When bundling assets with `IgnoreMode.GIT`, files that should be included via negation patterns (like `!*.html`) are incorrectly excluded if they're inside directories that are also re-included by negation patterns. Here's an example - consider the following tree:
```
- index.html
- app/
    - component.js
    - index.html
    - home.html
```

If we use a `exclude` pattern of `['*', '!*.html', '!*/']`, the `index.html` in the root and both HTML files from the `app` folder should be included - the `app` folder shouldn't be excluded, due to the `!*/` pattern. Right now, only the `index.html` file in the root folder is included.

### Description of changes

Similar to #22002, I've updated the `completelyIgnores` logic that's used to check if we need to skip a directory tree to include a trailing slash before verifying whether it's an ignored pattern. This makes it properly match directory-specific negation patterns like `!*/` by ensuring we're checking directory paths (with trailing slashes) against directory patterns.

I've also updated the logic in `fingerprint` to check if we're ignoring directories or files, and call `completelyIgnores` or `ignores` accordingly.

### Describe any new or updated permissions being added


None.

### Description of how you validated changes


Added unit tests covering the described scenarios.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: ekisu

packages/aws-cdk-lib/core/lib/fs/fingerprint.ts

@@ -66,12 +66,12 @@ export function fingerprint(fileOrDirectory: string, options: FingerprintOptions
   return hash.digest('hex');
 
   function _processFileOrDirectory(symbolicPath: string, isRootDir: boolean = false, realPath = symbolicPath) {
-    if (!isRootDir && ignoreStrategy.ignores(symbolicPath)) {
+    const stat = fs.lstatSync(realPath);
+
+    if (_shouldIgnore(isRootDir, symbolicPath, realPath, stat)) {
       return;
     }
 
-    const stat = fs.lstatSync(realPath);
-
     // Use relative path as hash component. Normalize it with forward slashes to ensure
     // same hash on Windows and Linux.
     const hashComponent = path.relative(fileOrDirectory, symbolicPath).replace(/\\/g, '/');
@@ -94,6 +94,32 @@ export function fingerprint(fileOrDirectory: string, options: FingerprintOptions
       throw new UnscopedValidationError(`Unable to hash ${symbolicPath}: it is neither a file nor a directory`);
     }
   }
+
+  function _shouldIgnore(isRootDir: boolean, symbolicPath: string, realPath: string, stat: fs.Stats) {
+    if (isRootDir) {
+      return false;
+    }
+
+    if (stat.isDirectory()) {
+      return ignoreStrategy.completelyIgnores(symbolicPath);
+    }
+
+    if (stat.isSymbolicLink()) {
+      const linkTarget = fs.readlinkSync(symbolicPath);
+      const resolvedLinkTarget = path.resolve(path.dirname(realPath), linkTarget);
+
+      if (shouldFollow(follow, rootDirectory, resolvedLinkTarget)) {
+        const targetStat = fs.statSync(resolvedLinkTarget);
+
+        // If we are following a directory symlink, we should use `completelyIgnores`.
+        if (targetStat.isDirectory()) {
+          return ignoreStrategy.completelyIgnores(symbolicPath);
+        }
+      }
+    }
+
+    return ignoreStrategy.ignores(symbolicPath);
+  }
 }
 
 export function contentFingerprint(file: string): string {

packages/aws-cdk-lib/core/lib/fs/ignore.ts

@@ -80,14 +80,13 @@ export abstract class IgnoreStrategy {
   public abstract ignores(absoluteFilePath: string): boolean;
 
   /**
-   * Determines whether a given file path should be ignored and have all of its children ignored
-   * if its a directory.
+   * Determines whether a given directory path should be ignored and have all of its children ignored.
    *
-   * @param absoluteFilePath absolute file path to be assessed against the pattern
-   * @returns `true` if the file should be ignored
+   * @param absoluteDirectoryPath absolute directory path to be assessed against the pattern
+   * @returns `true` if the directory and all of its children should be ignored
    */
-  public completelyIgnores(absoluteFilePath: string): boolean {
-    return this.ignores(absoluteFilePath);
+  public completelyIgnores(absoluteDirectoryPath: string): boolean {
+    return this.ignores(absoluteDirectoryPath);
   }
 }
 
@@ -189,6 +188,23 @@ export class GitIgnoreStrategy extends IgnoreStrategy {
 
     return this.ignore.ignores(relativePath);
   }
+
+  /**
+   * Determines whether a given directory path should be ignored and have all of its children ignored.
+   *
+   * @param absoluteDirectoryPath absolute directory path to be assessed against the pattern
+   * @returns `true` if the directory and all of its children should be ignored
+   */
+  public completelyIgnores(absoluteDirectoryPath: string): boolean {
+    if (!path.isAbsolute(absoluteDirectoryPath)) {
+      throw new UnscopedValidationError('GitIgnoreStrategy.completelyIgnores() expects an absolute path');
+    }
+
+    const relativePath = path.relative(this.absoluteRootPath, absoluteDirectoryPath);
+    const relativePathWithSep = relativePath.endsWith(path.sep) ? relativePath : relativePath + path.sep;
+
+    return this.ignore.ignores(relativePathWithSep);
+  }
 }
 
 /**
@@ -268,14 +284,13 @@ export class DockerIgnoreStrategy extends IgnoreStrategy {
   }
 
   /**
-   * Determines whether a given file path should be ignored and have all of its children ignored
-   * if its a directory.
+   * Determines whether a given directory path should be ignored and have all of its children ignored.
    *
-   * @param absoluteFilePath absolute file path to be assessed against the pattern
-   * @returns `true` if the file should be ignored
+   * @param absoluteDirectoryPath absolute directory path to be assessed against the pattern
+   * @returns `true` if the directory and all of its children should be ignored
    */
-  public completelyIgnores(absoluteFilePath: string): boolean {
-    const relativePath = this.getRelativePath(absoluteFilePath);
+  public completelyIgnores(absoluteDirectoryPath: string): boolean {
+    const relativePath = this.getRelativePath(absoluteDirectoryPath);
     return this.ignore.ignores(relativePath) && this.completeIgnore.ignores(relativePath);
   }
 }

packages/aws-cdk-lib/core/test/fs/fs-copy.test.ts

@@ -142,6 +142,28 @@ describe('fs copy', () => {
       '        file3.txt',
     ]);
   });
+
+  test('negated pattern inside subdirectory with git ignore mode', () => {
+    // GIVEN
+    const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
+
+    // WHEN
+    FileSystem.copyDirectory(path.join(__dirname, 'fixtures', 'test1'), outdir, {
+      exclude: [
+        '*',
+        '!.hidden',
+        '!*/',
+      ],
+      ignoreMode: IgnoreMode.GIT,
+    });
+
+    // THEN
+    expect(tree(outdir)).toEqual([
+      'subdir2 (D)',
+      '    empty-subdir (D)',
+      '        .hidden',
+    ]);
+  });
 });
 
 function tree(dir: string, depth = ''): string[] {

packages/aws-cdk-lib/core/test/fs/fs-fingerprint.test.ts

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { FileSystem, SymlinkFollowMode } from '../../lib/fs';
+import { FileSystem, IgnoreMode, SymlinkFollowMode } from '../../lib/fs';
 import { contentFingerprint } from '../../lib/fs/fingerprint';
 
 describe('fs fingerprint', () => {
@@ -91,6 +91,25 @@ describe('fs fingerprint', () => {
       // THEN
       expect(hashSrc).not.toEqual(hashCopy);
     });
+
+    test('changes with negated gitignore patterns inside ignored directories', () => {
+      // GIVEN
+      const srcdir = path.join(__dirname, 'fixtures', 'symlinks');
+      const cpydir = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
+      FileSystem.copyDirectory(srcdir, cpydir);
+
+      // Add a new file that is inside an ignored directory, but has a negated pattern that includes it.
+      const newFile = path.join(cpydir, 'ignored-dir', 'not-ignored-anymore.html');
+      fs.mkdirSync(path.dirname(newFile), { recursive: true });
+      fs.writeFileSync(newFile, '<h1>Do not ignore me!</h1>');
+
+      // WHEN
+      const hashSrc = FileSystem.fingerprint(srcdir, { exclude: ['*', '!*.html', '!*/'], ignoreMode: IgnoreMode.GIT });
+      const hashCopy = FileSystem.fingerprint(cpydir, { exclude: ['*', '!*.html', '!*/'], ignoreMode: IgnoreMode.GIT });
+
+      // THEN
+      expect(hashSrc).not.toEqual(hashCopy);
+    });
   });
 
   describe('symlinks', () => {
@@ -147,6 +166,44 @@ describe('fs fingerprint', () => {
       expect(original).toEqual(afterChange);
       expect(afterRevert).toEqual(original);
     });
+
+    test('changes when following directory symlinks with negated gitignore patterns', () => {
+      // GIVEN
+      const srcdir = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
+      fs.mkdirSync(path.join(srcdir, 'subdir'), { recursive: true });
+      fs.writeFileSync(path.join(srcdir, 'subdir', 'page.html'), '<h1>Hello, world!</h1>');
+
+      const cpydir = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
+      FileSystem.copyDirectory(srcdir, cpydir);
+      fs.symlinkSync(path.join(cpydir, 'subdir'), path.join(cpydir, 'link-to-dir'));
+
+      // WHEN
+      const options = { exclude: ['*', '!*.html', '!*/'], ignoreMode: IgnoreMode.GIT, follow: SymlinkFollowMode.ALWAYS };
+      const hashSrc = FileSystem.fingerprint(srcdir, options);
+      const hashCpy = FileSystem.fingerprint(cpydir, options);
+
+      // THEN
+      expect(hashSrc).not.toEqual(hashCpy);
+    });
+
+    test('does not change when not following directory symlinks with negated gitignore patterns', () => {
+      // GIVEN
+      const srcdir = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
+      fs.mkdirSync(path.join(srcdir, 'subdir'), { recursive: true });
+      fs.writeFileSync(path.join(srcdir, 'subdir', 'page.html'), '<h1>Hello, world!</h1>');
+
+      const cpydir = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
+      FileSystem.copyDirectory(srcdir, cpydir);
+      fs.symlinkSync(path.join(cpydir, 'subdir'), path.join(cpydir, 'link-to-dir'));
+
+      // WHEN
+      const options = { exclude: ['*', '!*.html', '!*/'], ignoreMode: IgnoreMode.GIT, follow: SymlinkFollowMode.NEVER };
+      const hashSrc = FileSystem.fingerprint(srcdir, options);
+      const hashCpy = FileSystem.fingerprint(cpydir, options);
+
+      // THEN
+      expect(hashSrc).toEqual(hashCpy);
+    });
   });
 
   describe('eol', () => {