Git

Git

Identities

The author is picked by where the repo is and where it comes from (.gitconfig):

• under ~/work/: the work identity, ~/.gitconfig-work (per machine; the repo holds a placeholder)
• a remote of the personal GitHub or GitLab account (git@github.com:user-cube/… and the other URL forms): ~/.gitconfig-personal-github / -gitlab, which win over work
• anywhere else: no identity, so a commit stops ("Please tell me who you are") instead of using a guessed user@host.local (useConfigOnly)

Commits are signed with SSH keys (through the Bitwarden SSH agent when it runs), and git log --show-signature verifies them locally (.config/git/allowed_signers).

Defaults

pull rebases (autostash), fetch prunes branches and tags, conflicts in zdiff3 with rerere (a conflict resolved once resolves itself, staged), histogram diffs with moved lines colored, push sets the upstream and sends the annotated tags, branches and tags newest first, main for new repos, status through fsmonitor, the diff in the commit editor, autoSquash for fixup! commits.

Global gitignore

.config/git/ignore: macOS and editor files, tool state (.direnv/, .terraform/), and env files as a safety net (.env, .env.*, but not .env.example; git add -f overrides).

Global hooks

Run in every repo as config-based hooks (git 2.54+), next to each repo's own .git/hooks, wired in .gitconfig-hooks:

Hook	Checks
gitleaks	the staged changes, for secrets
actionlint	the staged GitHub Actions workflows
gitlab-ci-lint	the staged .gitlab-ci.yml, through the GitLab API (glab ci lint)
terraform-fmt	the staged *.tf / *.tfvars, through tofu fmt
shellcheck	the staged shell scripts, warning level
hadolint	the staged Dockerfiles
sops-guard (Go)	a file sops should have encrypted, staged in cleartext
commit-msg (Go)	the Conventional Commit prefix and the issue key from the branch; blocks commits on main / master / develop; off in the personal repos

• Each checks the files as staged, and does nothing when its tool isn't installed.
• Skip once: git commit --no-verify. Off in a repo: git config hook.<name>.enabled false.
• The Go hooks print colors and emojis on a terminal and plain text in lazygit, VS Code and CI.
• sops-guard is a Go binary built by dotfiles-sync: until it is, commits stop with "sops-guard is not built: run dotfiles-sync".
• commit-msg: fix thing on feat/ABC-123-x becomes fix: ABC-123 thing; per-repo defaults in ~/.config/git/commit-msg.yaml (its README).

Reference: git_hooks README.