s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

Chapter 8Name in the course: Git security for DevSecOps

Secure your Git work

Git repositories are a favourite target: leaked keys, fake commits, and changed pipelines. This chapter shows how to keep secrets out, sign commits, scan before every commit with hooks, and what to do when a secret leaks.

  • 5 Lessons
  • 3 Commands

$ run as a normal user# run as root (or with sudo)

8.1

Keep secrets out of Git

A secret in Git history is public forever for everyone who can clone — even after you delete the file.

  • Put secrets in a secret store (Key Vault, Vault, GitHub secrets) — never in code.
  • Use .env files locally and list them in .gitignore.
  • Commit an example file without values: .env.example.
echo ".env" >> .gitignore
git check-ignore -v .env

8.2

Scan for secrets

Scanners find keys and passwords by patterns and entropy — locally, in pre-commit hooks and in CI.

gitleaks detect --source . --redact
gitleaks protect --staged
trufflehog git file://. --only-verified

On GitHub, turn on secret scanning and push protection (Settings → Code security): GitHub blocks a push that contains a known secret type.

8.3

Stop mistakes with pre-commit hooks

A hook is a script Git runs at an event. A pre-commit hook can stop a commit with a secret, a format error or a failing check.

.pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.24.0
    hooks:
      - id: gitleaks
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.96.1
    hooks:
      - id: terraform_fmt
      - id: terraform_validate
pip install pre-commit
pre-commit install
pre-commit run --all-files

Remember

Local hooks can be skipped (--no-verify). Run the same checks again in CI — the pipeline is the real gate.

8.4

Sign your commits

Anybody can set any name and email in a commit. A signature proves the commit came from your key. GitHub shows it as Verified.

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true
git commit -m "Signed change"
git log --show-signature -1

Add the same public key in GitHub → Settings → SSH and GPG keys → Signing key.

Commands in this lesson

8.5

React to a leaked secret

Assume a leaked secret is already used by an attacker. Order: revoke, then clean.

  1. Revoke / rotate the secret at once (new key, new password).
  2. Check the logs of that system for misuse.
  3. Remove it from the code and add a check so it does not happen again.
  4. Optional: rewrite the history (git filter-repo) and force-push — only after rotation, and tell everyone to re-clone.
pip install git-filter-repo
git filter-repo --path secrets.env --invert-paths

Watch out

Rewriting history does not remove the secret from forks, clones and caches. Rotation is the only real fix.

Commands in this lesson

All commands in this chapter