I use alint [0][1] to define and enforce rules about files/globs that should or shouldn't be committed, among other things. You can configure it run as a pre-commit hook or in CI.

(disclaimer - this is my own tool)

[0] https://github.com/asamarts/alint

[1] https://alint.org/docs/rules/git-hygiene/git_no_denied_paths...