The clean filter approach mentioned by jthill is the right approach. +1

It forces the file to be restored each time it is "added" to the index (meaning it never is actually added, since it hasn't changed).
Problem: How to force users to define it?
Solution: make them clone a template repo, which already contains:
- that empty file,
- and the
.gitattributes
file with the clean filter declared in it
If you set your main centralized repo to deny a ref update which is not a fast-forward one (git config receive.denyNonFastForwards true
), your users won't have any choice but to push from a repo with the same common history than your template repo.
That means they will have those settings in place.
Sure they could delete said settings in a new commit, but that is when the pre-receive
hooks from jthill's answer kicks in.
If they don't need to know about that files, chances are they won't mess with what was already defined for them.