G
GuideDevOps
Lesson 17 of 18

Git Best Practices & Security

Part of the Git & Version Control tutorial series.

Writing good Git commits and maintaining a clean history is essential for any DevOps team. These best practices and security measures will make your collaboration more professional and robust.

1. Commit Messages (Conventional Commits)

A clear, consistent format for commit messages makes history easy to read and allows for automated changelog generation.

Standard Format:

<type>(<scope>): <subject>
 
<body>
<footer>

Common Types:

TypePurpose
featA new feature
fixA bug fix
docsDocumentation changes
styleFormatting (no code changes)
refactorCode restructuring (no behavior change)
choreBuild scripts, tools, or dependencies

2. Branch Naming Conventions

Use a consistent prefix to identify what a branch is for.

Branch NameUse Case
mainProduction code (always deployable)
devCurrent development work
feature/login-v2New feature
fix/issue-123Bug fix
hotfix/security-patchUrgent production fix

3. Security: Signed Commits

In high-security DevOps environments, you should sign your commits using GPG or SSH keys. This proves that you are the real author.

Check if a Commit is Signed:

Action:

git log --show-signature -1

Result:

commit a1b2c3d4e5f6g7h8...
gpg: Signature made Fri Apr 10 14:00:00 2026 GMT
gpg:                using RSA key 1234567890ABCDEF
gpg: Good signature from "John Doe <john@example.com>"

4. Security: Credential Helpers

Don't type your password every time you push. Use a secure credential helper to cache or store your credentials.

Action:

git config --global credential.helper cache

5. Branch Protection Rules

In tools like GitHub or GitLab, never let anyone push directly to main. Always use:

  1. Pull Requests (Mandatory code review).
  2. Status Checks (CI/CD pipelines must pass).
  3. Signed Commits (Required).

6. The "Golden Rules" of Git

  1. Atomic Commits: Each commit should do exactly one thing.
  2. Write Good Messages: Explain why you made the change.
  3. Rebase Before Merging: Keep a clean, linear history.
  4. Pull Before Starting: Always sync your branch before you start working.
  5. Never Commit Secrets: Use .gitignore and secret managers.

Summary

  • Use Conventional Commits.
  • Sign your commits for security.
  • Protect your main branch.
  • Keep commits atomic and messages descriptive.