Secure your Git work

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

Keep secrets out of Git

A secret in Git history is public forever for everyone who can clone — even after you delete the file.

Put secrets in a secret store (Key Vault, Vault, GitHub secrets) — never in code.
Use .env files locally and list them in .gitignore.
Commit an example file without values: .env.example.

$echo ".env" >> .gitignore
$git check-ignore -v .env

8.2

Scan for secrets

Scanners find keys and passwords by patterns and entropy — locally, in pre-commit hooks and in CI.

$gitleaks detect --source . --redact
$gitleaks protect --staged
$trufflehog git file://. --only-verified

On GitHub, turn on secret scanning and push protection (Settings → Code security): GitHub blocks a push that contains a known secret type.

8.3

Stop mistakes with pre-commit hooks

A hook is a script Git runs at an event. A pre-commit hook can stop a commit with a secret, a format error or a failing check.

.pre-commit-config.yaml

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.24.0
    hooks:
      - id: gitleaks
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.96.1
    hooks:
      - id: terraform_fmt
      - id: terraform_validate

$pip install pre-commit
$pre-commit install
$pre-commit run --all-files

تذكّر

Local hooks can be skipped (--no-verify). Run the same checks again in CI — the pipeline is the real gate.

8.4

Sign your commits

Anybody can set any name and email in a commit. A signature proves the commit came from your key. GitHub shows it as Verified.

$git config --global gpg.format ssh
$git config --global user.signingkey ~/.ssh/id_ed25519.pub
$git config --global commit.gpgsign true
$git config --global tag.gpgsign true
$git commit -m "Signed change"
$git log --show-signature -1

Add the same public key in GitHub → Settings → SSH and GPG keys → Signing key.

8.5

React to a leaked secret

Assume a leaked secret is already used by an attacker. Order: revoke, then clean.

Revoke / rotate the secret at once (new key, new password).
Check the logs of that system for misuse.
Remove it from the code and add a check so it does not happen again.
Optional: rewrite the history (git filter-repo) and force-push — only after rotation, and tell everyone to re-clone.

$pip install git-filter-repo
$git filter-repo --path secrets.env --invert-paths

انتبه

Rewriting history does not remove the secret from forks, clones and caches. Rotation is the only real fix.

كل الأوامر في هذا الفصل