Git Advanced: Monorepo, Submodules & Workflows · 课时

DevOps 中的 Git 安全：机密、签名与钩子

学习如何避免将秘密信息提交到 Git，使用签名提交验证作者身份，并通过 DevOps 和自动化流水线中的钩子自动执行策略。

DevOps 中的 Git 安全：机密、签名与钩子 是 CoddyKit 上的免费 Git Advanced: Monorepo, Submodules & Workflows 课时。这是第 4 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Git Advanced: Monorepo, Submodules & Workflows 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Git Advanced: Monorepo, Submodules & Workflows 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Git Is a Security Surface

In DevOps, Git drives deployments. That makes the repository a security surface: a leaked secret or a forged commit can compromise production. Securing Git is part of securing the pipeline.

Keep Secrets Out of History

Never commit API keys, tokens, or passwords. Once in history, a secret is effectively public forever, even after deletion, because the old commit still contains it.

Use a .gitignore and environment variables instead.

.env
*.pem
secrets/
config/credentials.json

Scanning for Leaked Secrets

Automated scanners catch secrets before they merge. Wire one into CI so a leaked token fails the build.

gitleaks detect --source . --verbose

If a Secret Leaks

If a secret reaches the remote, two steps are mandatory:

Rotate the credential immediately — assume it is compromised
Purge it from history with a tool like git filter-repo

Rotation matters more than purging.

git filter-repo --path config/credentials.json --invert-paths

Signing Commits

Signed commits prove who authored them. In automated environments this prevents impersonation and lets pipelines trust commit authorship.

git config commit.gpgsign true
git commit -S -m 'Deploy config update'

Verifying Signatures

CI can require that every commit on a protected branch is signed and verified, rejecting unsigned or unknown-key commits before they deploy.

git log --show-signature -1
git verify-commit HEAD

Client-Side Hooks

Hooks run scripts at Git lifecycle events. A pre-commit hook can block secrets or run linters before a commit is ever created.

#!/bin/sh
# .git/hooks/pre-commit
gitleaks protect --staged || exit 1

Server-Side Hooks

Client hooks can be bypassed. Server-side hooks (pre-receive) enforce policy centrally, rejecting non-compliant pushes for everyone, no matter their local setup.

#!/bin/sh
# pre-receive: reject force pushes to main
while read old new ref; do
  if [ "$ref" = 'refs/heads/main' ]; then
    echo 'Direct pushes to main are blocked'; exit 1
  fi
done

Branch Protection as Policy

Platform branch-protection rules complement hooks: require reviews, passing CI, and signed commits before merge. Policy enforced at the platform cannot be bypassed locally.

Least Privilege for Automation

Deploy bots should use scoped, short-lived tokens, not personal credentials. Grant only the access a job needs, and rotate tokens regularly to limit blast radius.

Auditing the Audit Trail

Git history and platform logs form an audit trail. Protect them: disallow history rewrites on shared branches and review who has admin rights, so the record of what shipped stays trustworthy.

Quick Check

Test your understanding of Git security in DevOps.

Recap

You learned to secure Git in DevOps: keep secrets out of history, scan automatically, rotate then purge on leaks, use signed commits, enforce policy with client and server-side hooks and branch protection, and apply least privilege to automation tokens.

常见问题解答

「DevOps 中的 Git 安全：机密、签名与钩子」课时是免费的吗？

是的 — 「DevOps 中的 Git 安全：机密、签名与钩子」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Git Advanced: Monorepo, Submodules & Workflows 课程的其余内容，请升级到 CoddyKit PRO。 Git Advanced: Monorepo, Submodules & Workflows 课程共包含 4 节课。

「DevOps 中的 Git 安全：机密、签名与钩子」这节课中我会学到什么？

学习如何避免将秘密信息提交到 Git，使用签名提交验证作者身份，并通过 DevOps 和自动化流水线中的钩子自动执行策略。你通过在浏览器中直接运行的动手代码来练习 Git Advanced: Monorepo, Submodules & Workflows，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Git Advanced: Monorepo, Submodules & Workflows 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Git Advanced: Monorepo, Submodules & Workflows 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 4 节课，共 4 节。

「DevOps 中的 Git 安全：机密、签名与钩子」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Git Advanced: Monorepo, Submodules & Workflows 课中编写并运行代码吗？

能。每节 Git Advanced: Monorepo, Submodules & Workflows 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Git Advanced: Monorepo, Submodules & Workflows