[BUG] `npm publish` doesn't ignore non-top-level directories specified in .gitignore

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm publish includes files in directories that are ignored by git, when the directory is within another directory but is specified in .gitignore by name only rather than by path.

Expected Behavior

npm publish should ignore the same files that git ignores (in the absence of a .npmignore file).

Steps To Reproduce

1. Initialize a package
2. Create a subdirectory, e.g. src/sandbox/
3. Create a file inside the subdirectory, e.g. src/sandbox/tester.js
4. Add the subdirectory name to .gitignore, e.g. sandbox/

   % cat .gitignore
   sandbox/
   

5. Run git status; observe that the test file is ignored:

   % git status      
   On branch main
   
   No commits yet
   
   Untracked files:
     (use "git add <file>..." to include in what will be committed)
       .gitignore
       package.json
   
   nothing added to commit but untracked files present (use "git add" to track)
   

6. Run npm publish --dry-run; observe that the test file is not ignored:

   % npm publish --dry-run
   npm notice 
   npm notice 📦  npm-publish-bug@1.0.0
   npm notice === Tarball Contents === 
   npm notice 211B package.json         
   npm notice 0B   src/sandbox/tester.js
   npm notice === Tarball Details === 
   npm notice name:          npm-publish-bug                         
   npm notice version:       1.0.0                                   
   npm notice filename:      npm-publish-bug-1.0.0.tgz               
   npm notice package size:  278 B                                   
   npm notice unpacked size: 211 B                                   
   npm notice shasum:        26b335bd20490959ace8dbd0ce29a6287174f7a5
   npm notice integrity:     sha512-BIbW3gL2xZbP6[...]MSrX/626GdWWg==
   npm notice total files:   2                                       
   npm notice 
   npm notice Publishing to https://registry.npmjs.org/ (dry-run)
   + npm-publish-bug@1.0.0
   

7. Specifying the directory in .gitignore by path works for both npm publish and git:

   % cat .gitignore
   src/sandbox/
   

Environment

• npm: 8.10.0
• Node.js: v14.15.4
• OS Name: macOS Monterey 12.13.1
• System Model Name: MacBook Pro
• npm config:

; "user" config from /Users/{USERNAME}/.npmrc

//registry.npmjs.org/:_authToken = (protected) 

; "env" config from environment

prefix = "/Users/{USERNAME}/.asdf/installs/nodejs/14.15.4/.npm" 

; node bin location = /Users/{USERNAME}/.asdf/installs/nodejs/14.15.4/bin/node
; node version = v14.15.4
; npm local prefix = /Users/{USERNAME}/git/npm-publish-bug
; npm version = 8.10.0
; cwd = /Users/{USERNAME}/git/npm-publish-bug
; HOME = /Users/...
; Run `npm config ls -l` to show all defaults.