[BUG] watch rebuilds in an endless loop when the watched path contains .git #14362

Description

With a rebuild watch rule whose path contains the repository's .git directory (for example path: . in a project at the repository root), a single source edit makes docker compose watch rebuild over and over: about 30 rebuilds in 30 seconds, and it never stops. An empty git commit starts the same loop. With a sync rule, git operations sync the .git contents into the container.

.git/ is meant to be always ignored (pkg/compose/watch.go adds a hardcoded .git/ ignore rule), but that rule never matches inside the project. Every build then feeds the loop: buildx reads the git state of the build context for provenance and updates .git while doing so, and watch sees that as a new change.

Expected: changes under .git/ are ignored, so one edit triggers one rebuild.

Workaround: add .git to .dockerignore, or set BUILDX_GIT_INFO=0.

Expected: changes under .git/ inside the watched path are ignored.

Steps To Reproduce

# Dockerfile
FROM alpine
COPY app.txt /app.txt
CMD ["sleep", "infinity"]

# compose.yaml
services:
  app:
    build: .
    init: true
    develop:
      watch:
        - action: rebuild
          path: .

$ echo hi > app.txt
$ git init -q && git add . && git commit -qm init
$ docker compose up -d --build
$ docker compose watch --no-up > /tmp/watch.log 2>&1 &   # log outside the watched path
$ echo x >> app.txt                                      # one edit
$ sleep 30; grep -c Rebuilding /tmp/watch.log
32

With nothing edited, the count stays at 0. With .git in .dockerignore or BUILDX_GIT_INFO=0, one edit gives 1.

Compose Version

Docker Compose version 5.0.1
Also reproduced on main (289d8a037).
buildx v0.30.1-desktop.1 (also v0.24.0)

Docker Environment

Docker Engine 29.1.3 (linux/arm64, Docker Desktop on macOS)

Anything else?

The rule is built with watch.NewDockerPatternMatcher("/", []string{".git/"}) in pkg/compose/watch.go (two places). Patterns are joined to the base path, so this becomes /.git/ and only matches a .git at the filesystem root. Events carry full paths such as /home/me/project/.git/index, so they never match.

With **/.git instead, a local build of main stops the loop: one edit gives 1 rebuild, an empty commit gives 0, and .git is no longer synced. **/.git matches .git and its contents at any depth, but not .gitignore or .github/.

#14217 changes the same ignore set (it excludes the Dockerfile and compose files) but does not touch .git.