Day 26: Git hooks; GitHub Flow vs Trunk-Based; signed commits
Git hooks: local automation on every commit/push
A hook is a script Git runs automatically at a lifecycle point — pre-commit (before a commit is created, good for linting/formatting), commit-msg (validate the message format), pre-push (run tests before pushing). Hooks live in .git/hooks/ locally by default (not versioned), which is why teams use a tool like Husky to commit hook scripts into the repo itself.
#!/usr/bin/env bash
# .git/hooks/pre-commit
npm run lint || exit 1GitHub Flow vs Trunk-Based Development
GitHub Flow: every change is a short-lived feature branch off main, opened as a PR, reviewed, merged. Simple, works well for most teams. Trunk-Based Development: everyone commits directly to main (or very short-lived branches merged within a day), guarded by feature flags for anything not ready to ship — favored by high-velocity teams because it avoids long-lived branches accumulating painful merge conflicts.
The trade-off
GitHub Flow's branches are safer for less mature CI/testing setups but risk long-lived, conflict-heavy branches. Trunk-based demands strong CI and feature-flagging discipline, but this is exactly the pattern the Phase 14 CI/CD pipeline is built to support.
Signed commits
A signed commit is cryptographically signed with a GPG or SSH key, letting others (and GitHub itself) verify the commit really came from you, not someone impersonating your name/email (which anyone can set locally with git config user.name). This is a supply-chain integrity control — a direct precursor to the artifact signing (cosign) you'll see in Phase 14.
git config --global commit.gpgsign true
git config --global user.signingkey <KEY_ID>
git commit -S -m "Signed commit"The Four Questions: Trunk-Based Development (or signed commits)
Worked example for Docker: dependency hell → consistent runtime environments → VMs too heavy → shared kernel, weaker isolation. Apply the same shape to Trunk-Based Development: what problem (long-lived branch conflicts) did it solve, why couldn't long-lived feature branches solve it, and what trade-off (needing strong CI + feature flags) does it introduce?
Key terms
- Git hook
- A script Git runs automatically at a lifecycle event like commit or push.
- Trunk-Based Development
- Committing directly to main (or near it) frequently, using feature flags instead of long-lived branches.
- Signed commit
- A commit cryptographically signed to prove it really came from the claimed author.
Phase 3 complete — you should now be able to
Why can't git config user.name/user.email alone prove who authored a commit?
