vsce should respect .gitignore

[phil294]

About 0.5% of all extensions ship with a personal access token contained in clear text, most likely due to the mistake of putting secrets onto .gitignore but forgetting about .vscodeignore. I think you guys should do something about it.

[joaomoreno]

No, it shouldn't. Very common example of why this is a terrible idea: often you add *.js to .gitignore in a TypeScript project because you don't want to check-in your compilation output, but it's exactly what you want to include when distributing your extension. Same applies for build or node_modules.