Git, properly: the object model, the daily workflow, and how to undo anything

# Look at the machinery directly
git cat-file -t HEAD                 # commit
git cat-file -p HEAD                 # the raw commit object

# tree 9f2b...
# parent 4a1c...
# author Naiem <naiem@example.com> 1755100000 +0600
# committer Naiem <naiem@example.com> 1755100000 +0600
#
#     Add order validation

git cat-file -p HEAD^{tree}          # the directory listing it points at
git cat-file -p HEAD:src/app.ts      # the blob contents of one file

cat .git/HEAD                        # ref: refs/heads/main
cat .git/refs/heads/main             # 4a1c9f2b3d...

git rev-parse HEAD                   # resolve any ref to a hash
git rev-parse --abbrev-ref HEAD      # the current branch name

Working tree          Index (staging area)          HEAD / repository
─────────────         ────────────────────          ─────────────────
your actual files  →  what the next commit      →   committed history
                      will contain

     git add ─────────────►
                              git commit ─────────────►
     ◄───────────── git restore
     ◄──────────────────────────────── git restore --source=HEAD

git config --global user.name  "Naiem Inahid"
git config --global user.email "naiem@example.com"

# Default branch for new repositories
git config --global init.defaultBranch main

# Only fast-forward or explicit merges on pull - never a surprise merge commit
git config --global pull.ff only

# Push the current branch to its same-named upstream
git config --global push.default simple
git config --global push.autoSetupRemote true

# Remember how you resolved a conflict, and reapply it automatically next time
git config --global rerere.enabled true

# Better diffs
git config --global diff.algorithm histogram
git config --global diff.colorMoved zebra

# Sort branch listings by most recent activity
git config --global branch.sort -committerdate

# Keep the repository fast in the background
git maintenance start

# SSH signing - simpler than GPG and uses a key you already have
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true

git log --show-signature -1

[alias]
    s  = status -sb
    lg = log --graph --oneline --decorate --all
    last = log -1 HEAD --stat
    unstage = restore --staged
    amend = commit --amend --no-edit
    # branches by recency, with their upstream and last commit
    br = for-each-ref --sort=-committerdate refs/heads/ \
         --format='%(color:yellow)%(refname:short)%(color:reset) %(committerdate:relative) %(contents:subject)'
    # what have I not pushed?
    unpushed = log --oneline @{u}..HEAD

git status -sb                  # short, with branch and tracking info
git diff                        # working tree vs index - what is NOT staged
git diff --staged               # index vs HEAD - what WILL be committed

git add src/orders.ts           # stage a file
git add -p                      # stage selected hunks, interactively
git add -u                      # stage modifications and deletions, not new files

git commit -m "Reject orders with a zero total"
git commit --amend --no-edit    # fold staged changes into the last commit

git log --oneline -10
git log --graph --oneline --decorate --all

git add -p

# y - stage this hunk        n - skip it
# s - split into smaller hunks
# e - edit the hunk by hand
# q - quit                   ? - help

Add rate limiting to the login endpoint

Brute-force attempts against /auth/login were not throttled, so an
attacker could try passwords at the speed of the network.

Limits to five attempts per minute per IP, returning 429 with a
Retry-After header. The limit is deliberately per-IP rather than
per-account so that an attacker cannot lock out a real user.

Refs: SEC-214

git switch -c feature/order-limits      # create and switch
git switch main                         # switch
git switch -                            # back to the previous branch

git branch -d feature/order-limits      # delete if merged
git branch -D feature/order-limits      # delete regardless
git branch --merged main                # what is safe to delete

# Rebase your feature branch onto the latest main before opening a PR
git switch feature/order-limits
git fetch origin
git rebase origin/main

# If a conflict stops you
#   fix the files, then:
git add <resolved-files>
git rebase --continue
#   or, to give up entirely and return to where you started:
git rebase --abort

# Merge a finished branch into main with an explicit merge commit
git switch main
git merge --no-ff feature/order-limits

git rebase -i HEAD~5

# pick   4a1c9f2  Add order validation
# reword 8b3d1e4  fix typo            ← change the message
# squash 2c9f8a1  more validation     ← fold into the previous commit
# fixup  7e1b4c3  oops                ← fold in, discard the message
# drop   9d2a6f8  debug logging       ← delete the commit entirely
# edit   1f8c3b2  Refactor pricing    ← stop here so you can amend it

# The classic pattern for fixing an earlier commit
git add -p                              # stage just the fix
git commit --fixup=4a1c9f2
git rebase -i --autosquash 4a1c9f2~1    # positions it automatically

# Git 2.55 collapses that into one command (still experimental)
git add -p
git history fixup 4a1c9f2

git revert 4a1c9f2                # undo one commit
git revert 4a1c9f2..8b3d1e4       # undo a range
git revert -m 1 <merge-sha>       # undo a merge, keeping the first parent

git reflog

# 8b3d1e4 HEAD@{0}: reset: moving to HEAD~3
# 2c9f8a1 HEAD@{1}: commit: Add order limits
# 7e1b4c3 HEAD@{2}: rebase (finish): returning to refs/heads/feature

# Go back to where you were
git reset --hard HEAD@{1}

# Or recover the state onto a fresh branch, which is safer
git switch -c rescue 2c9f8a1

# Deleted a branch by mistake?
git reflog | grep "checkout: moving from feature/order-limits"

# Commits whose message matches
git log --grep="rate limit" --oneline

# Commits that ADDED or REMOVED a string - the pickaxe
git log -S "calculateVat" --oneline

# Commits whose diff matches a regex
git log -G "fetch\(.*retry" --oneline

# History of one file, following it through renames
git log --follow -p src/pricing.ts

# What changed on specific lines of a file
git log -L 40,80:src/pricing.ts

# Everything one author did last month
git log --author="Naiem" --since="1 month ago" --stat

git blame src/pricing.ts

# Ignore pure formatting commits so blame shows real authorship
git blame --ignore-revs-file .git-blame-ignore-revs src/pricing.ts

# Detect code moved from another file, not just edited in place
git blame -C -C src/pricing.ts

# Blame a specific line range
git blame -L 40,60 src/pricing.ts

# The commit that reformatted the entire codebase with Prettier
a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0
# The commit that converted tabs to spaces
b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1

git bisect start
git bisect bad                    # current commit is broken
git bisect good v1.4.0            # this tag was fine

# Git checks out a commit halfway between. Test it, then:
git bisect good     # or: git bisect bad
# …repeat until Git names the first bad commit

git bisect reset                  # return to where you started

# Fully automatic: give it a script that exits 0 for good, non-zero for bad
git bisect start HEAD v1.4.0
git bisect run npm test -- --testPathPattern=checkout

# Or a custom script
git bisect run ./scripts/reproduce-bug.sh

git remote -v
git remote add upstream https://github.com/org/repo.git

git fetch origin                  # download, change nothing locally
git fetch --prune                 # also delete refs for branches gone from the remote

git pull                          # fetch + merge (or rebase, depending on config)
git pull --rebase                 # fetch + rebase your local commits on top

git push -u origin feature/x      # push and set upstream tracking
git push --force-with-lease       # safe force: refuses if the remote moved

git status                        # lists the conflicted files

# In the file:
# <<<<<<< HEAD
#   your version
# =======
#   their version
# >>>>>>> feature/order-limits

# Better: show the common ancestor too, so you can see what each side changed
git config --global merge.conflictStyle zdiff3

# Take one side wholesale
git checkout --ours  config/prod.json
git checkout --theirs src/pricing.ts

# Or open a three-way merge tool
git mergetool

git add <resolved>
git commit                        # or: git rebase --continue

git stash push -m "half-done pricing refactor"
git stash push -p                 # stash selected hunks only
git stash push -u                 # include untracked files

git stash list
git stash show -p stash@{0}       # see what is in it
git stash apply stash@{0}         # apply, keep it in the list
git stash pop                     # apply and remove
git stash drop stash@{0}

git worktree add ../repo-review origin/feature/their-branch
cd ../repo-review                 # a full checkout, same .git objects

git worktree list
git worktree remove ../repo-review

#!/bin/sh
# .git/hooks/pre-commit - must be executable

if git diff --cached --name-only | grep -qE '\.(ts|tsx)$'; then
    npx tsc --noEmit || {
        echo "Type check failed. Commit aborted."
        exit 1
    }
fi

git submodule add https://github.com/org/lib.git vendor/lib
git clone --recurse-submodules <url>
git submodule update --init --recursive
git submodule update --remote          # move to the tracked branch's latest

# Shallow clone - history truncated, much faster
git clone --depth 1 <url>
git fetch --unshallow                  # get the rest later if you need it

# Partial clone - full history, blobs fetched on demand
git clone --filter=blob:none <url>

# Sparse checkout - only the directories you work in
git sparse-checkout init --cone
git sparse-checkout set apps/web packages/ui

# Speed up status on a huge working tree
git config core.fsmonitor true
git config core.untrackedCache true

# Background maintenance: prefetch, repack, commit-graph
git maintenance start

# What is taking up all the space?
git count-objects -vH

# 1. Rotate the credential. Right now. Before anything else.
#    Assume it is compromised - it was pushed, mirrored, and possibly indexed.

# 2. Then remove it from history
uvx git-filter-repo --path config/secrets.json --invert-paths

# 3. Force push, and tell everyone to reclone
git push --force --all

# Prevent it happening again
uvx detect-secrets scan --baseline .secrets.baseline