{"id":13461754,"url":"https://github.com/kubernetes/git-sync","last_synced_at":"2026-02-14T03:43:27.310Z","repository":{"id":37359596,"uuid":"66168197","full_name":"kubernetes/git-sync","owner":"kubernetes","description":"A sidecar app which clones a git repo and keeps it in sync with the upstream.","archived":false,"fork":false,"pushed_at":"2025-09-13T00:46:57.000Z","size":12074,"stargazers_count":2514,"open_issues_count":16,"forks_count":446,"subscribers_count":31,"default_branch":"master","last_synced_at":"2025-09-14T13:46:41.832Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kubernetes.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"code-of-conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2016-08-20T21:09:56.000Z","updated_at":"2025-09-12T14:53:07.000Z","dependencies_parsed_at":"2023-10-13T12:35:04.173Z","dependency_job_id":"947c42e0-353b-4bf9-876c-f22454171fd5","html_url":"https://github.com/kubernetes/git-sync","commit_stats":{"total_commits":649,"total_committers":74,"mean_commits":8.77027027027027,"dds":0.3328197226502311,"last_synced_commit":"69d239562de00def452e8606042e696aa991cf6c"},"previous_names":[],"tags_count":55,"template":false,"template_full_name":null,"purl":"pkg:github/kubernetes/git-sync","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes%2Fgit-sync","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes%2Fgit-sync/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes%2Fgit-sync/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes%2Fgit-sync/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kubernetes","download_url":"https://codeload.github.com/kubernetes/git-sync/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubernetes%2Fgit-sync/sbom","scorecard":{"id":572699,"data":{"date":"2025-08-11","repo":{"name":"github.com/kubernetes/git-sync","commit":"767db9dabfb9a936774c92703c93d93ed985af67"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":7,"checks":[{"name":"Maintained","score":10,"reason":"9 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: topLevel 'contents' permission set to 'read': .github/workflows/main.yml:13","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/kubernetes/git-sync/main.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/kubernetes/git-sync/main.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/kubernetes/git-sync/main.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/kubernetes/git-sync/main.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/kubernetes/git-sync/main.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/kubernetes/git-sync/main.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/kubernetes/git-sync/main.yml/master?enable=pin","Warn: containerImage not pinned by hash: Dockerfile.in:44","Warn: containerImage not pinned by hash: _test_tools/httpd/Dockerfile:17","Warn: containerImage not pinned by hash: _test_tools/ncsvr/Dockerfile:17","Warn: containerImage not pinned by hash: _test_tools/sshd/Dockerfile:17","Warn: containerImage not pinned by hash: pkg/pid1/test/fast-exit/Dockerfile:15: pin your Docker image by updating debian to debian@sha256:6d87375016340817ac2391e670971725a9981cfc24e221c47734681ed0f6c0f5","Info:   0 out of   6 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned","Info:   0 out of   5 containerImage dependencies pinned","Info:   1 out of   1 goCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":4,"reason":"6 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2022-1147 / GHSA-2qjp-425j-52j9","Warn: Project is vulnerable to: GO-2023-1573 / GHSA-259w-8hf6-59c2","Warn: Project is vulnerable to: GO-2023-1574 / GHSA-hmfx-3pcx-653p","Warn: Project is vulnerable to: GO-2023-2412 / GHSA-7ww5-4wqc-m92c","Warn: Project is vulnerable to: GO-2025-3528 / GHSA-265r-hfxg-fhmg","Warn: Project is vulnerable to: GO-2025-3701 / GHSA-cxfp-7pvr-95ff"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-20T16:46:25.847Z","repository_id":37359596,"created_at":"2025-08-20T16:46:25.847Z","updated_at":"2025-08-20T16:46:25.847Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278395910,"owners_count":25979690,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-04T02:00:05.491Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T11:00:56.659Z","updated_at":"2025-10-05T00:59:59.120Z","avatar_url":"https://github.com/kubernetes.png","language":"Shell","funding_links":[],"categories":["Shell","Go","HarmonyOS"],"sub_categories":["Windows Manager"],"readme":"# NOTE: THIS DOCUMENT COVERS GIT-SYNC v4\n\nThis is the \"master\" branch, which is under development.  If you are looking \nfor docs on older (v3) versions of git-sync, you probably want to use the\n[v3.x branch](https://github.com/kubernetes/git-sync/tree/release-3.x).\n\n# git-sync\n\ngit-sync is a simple command that pulls a git repository into a local\ndirectory, waits for a while, then repeats.  As the remote repository changes,\nthose changes will be synced locally.  It is a perfect \"sidecar\" container in\nKubernetes - it can pull files down from a repository so that an application\ncan consume them.\n\ngit-sync can pull one time, or on a regular interval.  It can pull from the\nHEAD of a branch, from a git tag, or from a specific git hash.  It will only\nre-pull if the referenced target has changed in the upstream repository (e.g. a\nnew commit on a branch).  It \"publishes\" each sync through a worktree and a\nnamed symlink.  This ensures an atomic update - consumers will not see a\npartially constructed view of the local repository.\n\ngit-sync can pull over HTTP(S) (with authentication or not) or SSH.\n\ngit-sync can also be configured to make a webhook call or exec a command upon\nsuccessful git repo synchronization. The call is made after the symlink is\nupdated.\n\n## What it produces and why - the contract\n\ngit-sync has two required flags: `--repo`, which specifies which remote git\nrepo to sync, and `--root` which specifies a working directory for git-sync,\nwhich presents an \"API\" of sorts.\n\nThe `--root` directory is _not_ the synced data.\n\nInside the `--root` directory git-sync stores the synced git state and other\nthings.  That directory may or may not respond to git commands - it's an\nimplementation detail.\n\nOne of the things in that directory is a symlink (see the `--link` flag) to the\nmost recently synced data.  This is how the data is expected to be consumed,\nand is considered to be the \"contract\" between git-sync and consumers.  The\nexact target of that symlink is an implementation detail, but the leaf\ncomponent of the target (i.e. `basename \"$(readlink \u003clink\u003e)\"`) is the git hash\nof the synced revision.  This is also part of the contract.\n\ngit-sync looks for changes in the remote repo periodically (see the `--period`\nflag) and will attempt to transfer as little data as possible and use as little\ndisk space as possible (see the `--depth` and `--git-gc` flags), but this is\nnot part of the contract.\n\n### Why the symlink?\n\ngit checkouts are not \"atomic\" operations.  If you look at the repository while\na checkout is happening, you might see data that is neither exactly the old\nrevision nor the new.  git-sync \"publishes\" updates via the symlink to present\nan atomic interface to consumers.  When the remote repo has changed, git-sync\nwill fetch the data _without_ checking it out, then create a new worktree, then\nchange the symlink to point to that new worktree.\n\ngit-sync does not currently have a no-symlink mode.\n\n## Major update: v3.x -\u003e v4.x\n\ngit-sync has undergone many significant changes between v3.x and v4.x.  [See\nhere](v3-to-v4.md) for more details.\n\n## Building it\n\nWe use [docker buildx](https://github.com/docker/buildx) to build images.\n\n```\n# build the container\nmake container REGISTRY=registry VERSION=tag\n```\n\n```\n# build the container behind a proxy\nmake container REGISTRY=registry VERSION=tag \\\n    HTTP_PROXY=http://\u003cproxy_address\u003e:\u003cproxy_port\u003e \\\n    HTTPS_PROXY=https://\u003cproxy_address\u003e:\u003cproxy_port\u003e\n```\n\n```\n# build the container for an OS/arch other than the current (e.g. you are on\n# MacOS and want to run on Linux)\nmake container REGISTRY=registry VERSION=tag \\\n    GOOS=linux GOARCH=amd64\n```\n\n## Usage\n\n```\n# make a directory (owned by you) for the volume\nexport DIR=\"/tmp/git-data\"\nmkdir -p $DIR\n\n# run the container (as your own UID)\ndocker run -d \\\n    -v $DIR:/tmp/git \\\n    -u$(id -u):$(id -g) \\\n    registry/git-sync:tag \\\n        --repo=https://github.com/kubernetes/git-sync \\\n        --root=/tmp/git/root \\\n        --period=30s\n\n# run an nginx container to serve the content\ndocker run -d \\\n    -p 8080:80 \\\n    -v $DIR:/usr/share/nginx/html \\\n    nginx\n```\n\n### Flags\n\ngit-sync has many flags and optional features (see the manual below).  Most of\nthose flags can be configured through environment variables, but in most cases\n(with the obvious exception of passwords) flags are preferred, because the\nprogram can abort if an invalid flag is specified, but a misspelled environment\nvariable will just be ignored.  We've tried to stay backwards-compatible across\nmajor versions (by accepting deprecated flags and environment variables), but\nsome things have evolved, and users are encouraged to use the most recent flags\nfor their major version.\n\n### Volumes\n\nThe `--root` flag must indicate either a directory that either a) does not\nexist (it will be created); or b) exists and is empty; or c) can be emptied by\nremoving all of the contents.\n\nWhy?  Git really wants an empty directory, to avoid any confusion.  If the\ndirectory exists and is not empty, git-sync will try to empty it by removing\neverything in it (we can't just `rm -rf` the dir because it might be a mounted\nvolume).  If that fails, git-sync will abort.\n\nWith the above example or with a Kubernetes `emptyDir`, there is usually no\nproblem.  The problematic case is when the volume is the root of a filesystem,\nwhich sometimes contains metadata (e.g. ext{2,3,4} have a `lost+found` dir).\nThe only real solution is to use a sub-directory of the volume as the `--root`.\n\n## More docs\n\nMore documentation on specific topics can be [found here](./docs).\n\n## Manual\n\n```\nGIT-SYNC\n\nNAME\n    git-sync - sync a remote git repository\n\nSYNOPSIS\n    git-sync --repo=\u003crepo\u003e --root=\u003cpath\u003e [OPTIONS]...\n\nDESCRIPTION\n\n    Fetch a remote git repository to a local directory, poll the remote for\n    changes, and update the local copy.\n\n    This is a perfect \"sidecar\" container in Kubernetes.  For example, it can\n    periodically pull files down from a repository so that an application can\n    consume them.\n\n    git-sync can pull one time, or on a regular interval.  It can read from the\n    HEAD of a branch, from a git tag, or from a specific git hash.  It will only\n    re-pull if the target has changed in the remote repository.  When it\n    re-pulls, it updates the destination directory atomically.  In order to do\n    this, it uses a git worktree in a subdirectory of the --root and flips a\n    symlink.\n\n    git-sync can pull over HTTP(S) (with authentication or not) or SSH.\n\n    git-sync can also be configured to make a webhook call upon successful git\n    repo synchronization.  The call is made after the symlink is updated.\n\nCONTRACT\n\n    git-sync has two required flags:\n      --repo: specifies which remote git repo to sync\n      --root: specifies a working directory for git-sync\n\n    The root directory is not the synced data.\n\n    Inside the root directory, git-sync stores the synced git state and other\n    things.  That directory may or may not respond to git commands - it's an\n    implementation detail.\n\n    One of the things in that directory is a symlink (see the --link flag) to\n    the most recently synced data.  This is how the data is expected to be\n    consumed, and is considered to be the \"contract\" between git-sync and\n    consumers.  The exact target of that symlink is an implementation detail,\n    but the leaf component of the target (i.e. basename \"$(readlink \u003clink\u003e)\")\n    is the git hash of the synced revision.  This is also part of the contract.\n\n    Why the symlink?  git checkouts are not \"atomic\" operations.  If you look\n    at the repository while a checkout is happening, you might see data that is\n    neither exactly the old revision nor the new.  git-sync \"publishes\" updates\n    via the symlink to present an atomic interface to consumers.  When the\n    remote repo has changed, git-sync will fetch the data _without_ checking it\n    out, then create a new worktree, then change the symlink to point to that\n    new worktree.\n\n    git-sync looks for changes in the remote repo periodically (see the\n    --period flag) and will attempt to transfer as little data as possible and\n    use as little disk space as possible (see the --depth and --git-gc flags),\n    but this is not part of the contract.\n\nOPTIONS\n\n    Many options can be specified as either a commandline flag or an environment\n    variable, but flags are preferred because a misspelled flag is a fatal\n    error while a misspelled environment variable is silently ignored.  Some\n    options can only be specified as an environment variable.\n\n    --add-user, $GITSYNC_ADD_USER\n            Add a record to /etc/passwd for the current UID/GID.  This is\n            needed to use SSH with an arbitrary UID.  This assumes that\n            /etc/passwd is writable by the current UID.\n\n    --askpass-url \u003cstring\u003e, $GITSYNC_ASKPASS_URL\n            A URL to query for git credentials.  The query must return success\n            (200) and produce a series of key=value lines, including\n            \"username=\u003cvalue\u003e\" and \"password=\u003cvalue\u003e\".\n\n    --cookie-file \u003cstring\u003e, $GITSYNC_COOKIE_FILE\n            Use a git cookiefile (/etc/git-secret/cookie_file) for\n            authentication.\n\n    --credential \u003cstring\u003e, $GITSYNC_CREDENTIAL\n            Make one or more credentials available for authentication (see git\n            help credential).  This is similar to --username and\n            $GITSYNC_PASSWORD or --password-file, but for specific URLs, for\n            example when using submodules.  The value for this flag is either a\n            JSON-encoded object (see the schema below) or a JSON-encoded list\n            of that same object type.  This flag may be specified more than\n            once.\n\n            Object schema:\n              - url:            string, required\n              - username:       string, required\n              - password:       string, optional\n              - password-file:  string, optional\n\n            One of password or password-file must be specified.  Users should\n            prefer password-file for better security.\n\n            Example:\n              --credential='{\"url\":\"https://github.com\", \"username\":\"myname\", \"password-file\":\"/creds/mypass\"}'\n\n    --depth \u003cint\u003e, $GITSYNC_DEPTH\n            Create a shallow clone with history truncated to the specified\n            number of commits.  If not specified, this defaults to syncing a\n            single commit.  Setting this to 0 will sync the full history of the\n            repo.\n\n    --error-file \u003cstring\u003e, $GITSYNC_ERROR_FILE\n            The path to an optional file into which errors will be written.\n            This may be an absolute path or a relative path, in which case it\n            is relative to --root.\n\n    --exechook-backoff \u003cduration\u003e, $GITSYNC_EXECHOOK_BACKOFF\n            The time to wait before retrying a failed --exechook-command.  If\n            not specified, this defaults to 3 seconds (\"3s\").\n\n    --exechook-command \u003cstring\u003e, $GITSYNC_EXECHOOK_COMMAND\n            An optional command to be executed after syncing a new hash of the\n            remote repository.  This command does not take any arguments and\n            executes with the synced repo as its working directory.  The\n            $GITSYNC_HASH environment variable will be set to the git hash that\n            was synced.  If, at startup, git-sync finds that the --root already\n            has the correct hash, this hook will still be invoked.  This means\n            that hooks can be invoked more than one time per hash, so they\n            must be idempotent.  This flag obsoletes --sync-hook-command, but\n            if sync-hook-command is specified, it will take precedence.\n\n    --exechook-timeout \u003cduration\u003e, $GITSYNC_EXECHOOK_TIMEOUT\n            The timeout for the --exechook-command.  If not specifid, this\n            defaults to 30 seconds (\"30s\").\n\n    --git \u003cstring\u003e, $GITSYNC_GIT\n            The git command to run (subject to PATH search, mostly for\n            testing).  This defaults to \"git\".\n\n    --git-config \u003cstring\u003e, $GITSYNC_GIT_CONFIG\n            Additional git config options in a comma-separated 'key:val'\n            format.  The parsed keys and values are passed to 'git config' and\n            must be valid syntax for that command.\n\n            Both keys and values can be either quoted or unquoted strings.\n            Within quoted keys and all values (quoted or not), the following\n            escape sequences are supported:\n                '\\n' =\u003e [newline]\n                '\\t' =\u003e [tab]\n                '\\\"' =\u003e '\"'\n                '\\,' =\u003e ','\n                '\\\\' =\u003e '\\'\n            To include a colon within a key (e.g. a URL) the key must be\n            quoted.  Within unquoted values commas must be escaped.  Within\n            quoted values commas may be escaped, but are not required to be.\n            Any other escape sequence is an error.\n\n    --git-gc \u003cstring\u003e, $GITSYNC_GIT_GC\n            The git garbage collection behavior: one of \"auto\", \"always\",\n            \"aggressive\", or \"off\".  If not specified, this defaults to\n            \"auto\".\n\n            - auto: Run \"git gc --auto\" once per successful sync.  This mode\n              respects git's gc.* config params.\n            - always: Run \"git gc\" once per successful sync.\n            - aggressive: Run \"git gc --aggressive\" once per successful sync.\n              This mode can be slow and may require a longer --sync-timeout value.\n            - off: Disable explicit git garbage collection, which may be a good\n              fit when also using --one-time.\n\n    --github-base-url \u003cstring\u003e, $GITSYNC_GITHUB_BASE_URL\n            The GitHub base URL to use in GitHub requests when GitHub app\n            authentication is used. If not specified, defaults to\n            https://api.github.com/.\n\n    --github-app-private-key-file \u003cstring\u003e, $GITSYNC_GITHUB_APP_PRIVATE_KEY_FILE\n            The file from which the private key to use for GitHub app\n            authentication will be read.\n\n    --github-app-installation-id \u003cint\u003e, $GITSYNC_GITHUB_APP_INSTALLATION_ID\n            The installation ID of the GitHub app used for GitHub app\n            authentication.\n\n    --github-app-application-id \u003cint\u003e, $GITSYNC_GITHUB_APP_APPLICATION_ID\n            The app ID of the GitHub app used for GitHub app authentication.\n            One of --github-app-application-id or --github-app-client-id is required\n            when GitHub app authentication is used.\n\n    --github-app-client-id \u003cint\u003e, $GITSYNC_GITHUB_APP_CLIENT_ID\n            The client ID of the GitHub app used for GitHub app authentication.\n            One of --github-app-application-id or --github-app-client-id is required\n            when GitHub app authentication is used.\n\n    --group-write, $GITSYNC_GROUP_WRITE\n            Ensure that data written to disk (including the git repo metadata,\n            checked out files, worktrees, and symlink) are all group writable.\n            This corresponds to git's notion of a \"shared repository\".  This is\n            useful in cases where data produced by git-sync is used by a\n            different UID.  This replaces the older --change-permissions flag.\n\n    -?, -h, --help\n            Print help text and exit.\n\n    --http-bind \u003cstring\u003e, $GITSYNC_HTTP_BIND\n            The bind address (including port) for git-sync's HTTP endpoint.\n            The '/' URL of this endpoint is suitable for Kubernetes startup and\n            liveness probes, returning a 5xx error until the first sync is\n            complete, and a 200 status thereafter. If not specified, the HTTP\n            endpoint is not enabled.\n\n            Examples:\n              \":1234\": listen on any IP, port 1234\n              \"127.0.0.1:1234\": listen on localhost, port 1234\n\n    --http-metrics, $GITSYNC_HTTP_METRICS\n            Enable metrics on git-sync's HTTP endpoint at /metrics.  Requires\n            --http-bind to be specified.\n\n    --http-pprof, $GITSYNC_HTTP_PPROF\n            Enable the pprof debug endpoints on git-sync's HTTP endpoint at\n            /debug/pprof.  Requires --http-bind to be specified.\n\n    --link \u003cstring\u003e, $GITSYNC_LINK\n            The path to at which to create a symlink which points to the\n            current git directory, at the currently synced hash.  This may be\n            an absolute path or a relative path, in which case it is relative\n            to --root.  Consumers of the synced files should always use this\n            link - it is updated atomically and should always be valid.  The\n            basename of the target of the link is the current hash.  If not\n            specified, this defaults to the leaf dir of --repo.\n\n    --man\n            Print this manual and exit.\n\n    --max-failures \u003cint\u003e, $GITSYNC_MAX_FAILURES\n            The number of consecutive failures allowed before aborting.\n            Setting this to a negative value will retry forever.  If not\n            specified, this defaults to 0, meaning any sync failure will\n            terminate git-sync.\n\n    --one-time, $GITSYNC_ONE_TIME\n            Exit after one sync.\n\n    $GITSYNC_PASSWORD\n            The password or personal access token (see github docs) to use for\n            git authentication (see --username).  See also --password-file.\n\n    --password-file \u003cstring\u003e, $GITSYNC_PASSWORD_FILE\n            The file from which the password or personal access token (see\n            github docs) to use for git authentication (see --username) will be\n            read.  See also $GITSYNC_PASSWORD.\n\n    --period \u003cduration\u003e, $GITSYNC_PERIOD\n            How long to wait between sync attempts.  This must be at least\n            10ms.  This flag obsoletes --wait, but if --wait is specified, it\n            will take precedence.  If not specified, this defaults to 10\n            seconds (\"10s\").\n\n    --ref \u003cstring\u003e, $GITSYNC_REF\n            The git revision (branch, tag, or hash) to check out.  If not\n            specified, this defaults to \"HEAD\" (of the upstream repo's default\n            branch).\n\n    --repo \u003cstring\u003e, $GITSYNC_REPO\n            The git repository to sync.  This flag is required.\n\n    --root \u003cstring\u003e, $GITSYNC_ROOT\n            The root directory for git-sync operations, under which --link will\n            be created.  This must be a path that either a) does not exist (it\n            will be created); b) is an empty directory; or c) is a directory\n            which can be emptied by removing all of the contents.  This flag is\n            required.\n\n    --sparse-checkout-file \u003cstring\u003e, $GITSYNC_SPARSE_CHECKOUT_FILE\n            The path to a git sparse-checkout file (see git documentation for\n            details) which controls which files and directories will be checked\n            out.  If not specified, the default is to check out the entire repo.\n\n    --ssh-key-file \u003cstring\u003e, $GITSYNC_SSH_KEY_FILE\n            The SSH key(s) to use when using git over SSH.  This flag may be\n            specified more than once and the environment variable will be\n            parsed like PATH - using a colon (':') to separate elements.  If\n            not specified, this defaults to \"/etc/git-secret/ssh\".\n\n    --ssh-known-hosts, $GITSYNC_SSH_KNOWN_HOSTS\n            Enable SSH known_hosts verification when using git over SSH.  If\n            not specified, this defaults to true.\n\n    --ssh-known-hosts-file \u003cstring\u003e, $GITSYNC_SSH_KNOWN_HOSTS_FILE\n            The known_hosts file to use when --ssh-known-hosts is specified.\n            If not specified, this defaults to \"/etc/git-secret/known_hosts\".\n\n    --stale-worktree-timeout \u003cduration\u003e, $GITSYNC_STALE_WORKTREE_TIMEOUT\n            The length of time to retain stale (not the current link target)\n            worktrees before being removed. Once this duration has elapsed,\n            a stale worktree will be removed during the next sync attempt\n            (as determined by --sync-timeout). If not specified, this defaults\n            to 0, meaning that stale worktrees will be removed immediately.\n\n    --submodules \u003cstring\u003e, $GITSYNC_SUBMODULES\n            The git submodule behavior: one of \"recursive\", \"shallow\", or\n            \"off\".  If not specified, this defaults to \"recursive\".\n\n    --sync-on-signal \u003cstring\u003e, $GITSYNC_SYNC_ON_SIGNAL\n            Indicates that a sync attempt should occur upon receipt of the\n            specified signal name (e.g. SIGHUP) or number (e.g. 1). If a sync\n            is already in progress, another sync will be triggered as soon as\n            the current one completes. If not specified, signals will not\n            trigger syncs.\n\n    --sync-timeout \u003cduration\u003e, $GITSYNC_SYNC_TIMEOUT\n            The total time allowed for one complete sync.  This must be at least\n            10ms.  This flag obsoletes --timeout, but if --timeout is specified,\n            it will take precedence.  If not specified, this defaults to 120\n            seconds (\"120s\").\n\n    --touch-file \u003cstring\u003e, $GITSYNC_TOUCH_FILE\n            The path to an optional file which will be touched whenever a sync\n            completes.  This may be an absolute path or a relative path, in\n            which case it is relative to --root.\n\n    --username \u003cstring\u003e, $GITSYNC_USERNAME\n            The username to use for git authentication (see --password-file or\n            $GITSYNC_PASSWORD).  If more than one username and password is\n            required (e.g. with submodules), use --credential.\n\n    -v, --verbose \u003cint\u003e, $GITSYNC_VERBOSE\n            Set the log verbosity level.  Logs at this level and lower will be\n            printed.  Logs follow these guidelines:\n\n            - 0: Minimal, just log updates\n            - 1: More details about updates\n            - 2: Log the sync loop\n            - 3: More details about the sync loop\n            - 4: More details\n            - 5: Log all executed commands\n            - 6: Log stdout/stderr of all executed commands\n            - 9: Tracing and debug messages\n\n    --version\n            Print the version and exit.\n\n    --webhook-backoff \u003cduration\u003e, $GITSYNC_WEBHOOK_BACKOFF\n            The time to wait before retrying a failed --webhook-url.  If not\n            specified, this defaults to 3 seconds (\"3s\").\n\n    --webhook-method \u003cstring\u003e, $GITSYNC_WEBHOOK_METHOD\n            The HTTP method for the --webhook-url.  If not specified, this defaults to \"POST\".\n\n    --webhook-success-status \u003cint\u003e, $GITSYNC_WEBHOOK_SUCCESS_STATUS\n            The HTTP status code indicating a successful --webhook-url.  Setting\n            this to 0 disables success checks, which makes webhooks\n            \"fire-and-forget\".  If not specified, this defaults to 200.\n\n    --webhook-timeout \u003cduration\u003e, $GITSYNC_WEBHOOK_TIMEOUT\n            The timeout for the --webhook-url.  If not specified, this defaults\n            to 1 second (\"1s\").\n\n    --webhook-url \u003cstring\u003e, $GITSYNC_WEBHOOK_URL\n            A URL for optional webhook notifications when syncs complete.  The\n            header 'Gitsync-Hash' will be set to the git hash that was synced.\n            If, at startup, git-sync finds that the --root already has the\n            correct hash, this hook will still be invoked.  This means that\n            hooks can be invoked more than one time per hash, so they must be\n            idempotent.\n\nEXAMPLE USAGE\n\n    git-sync \\\n        --repo=https://github.com/kubernetes/git-sync \\\n        --ref=HEAD \\\n        --period=10s \\\n        --root=/mnt/git\n\nAUTHENTICATION\n\n    Git-sync offers several authentication options to choose from.  If none of\n    the following are specified, git-sync will try to access the repo in the\n    \"natural\" manner.  For example, \"https://repo\" will try to use plain HTTPS\n    and \"git@example.com:repo\" will try to use SSH.\n\n    username/password\n            The --username ($GITSYNC_USERNAME) and $GITSYNC_PASSWORD or\n            --password-file ($GITSYNC_PASSWORD_FILE) flags will be used.  To\n            prevent password leaks, the --password-file flag or\n            $GITSYNC_PASSWORD environment variable is almost always preferred\n            to the --password flag, which is deprecated.\n\n            A variant of this is --askpass-url ($GITSYNC_ASKPASS_URL), which\n            consults a URL (e.g. http://metadata) to get credentials on each\n            sync.\n\n            When using submodules it may be necessary to specify more than one\n            username and password, which can be done with --credential\n            ($GITSYNC_CREDENTIAL).  All of the username+password pairs, from\n            both --username/$GITSYNC_PASSWORD and --credential are fed into\n            'git credential approve'.\n\n    SSH\n            When an SSH transport is specified, the key(s) defined in\n            --ssh-key-file ($GITSYNC_SSH_KEY_FILE) will be used.  Users are\n            strongly advised to also use --ssh-known-hosts\n            ($GITSYNC_SSH_KNOWN_HOSTS) and --ssh-known-hosts-file\n            ($GITSYNC_SSH_KNOWN_HOSTS_FILE) when using SSH.\n\n    cookies\n            When --cookie-file ($GITSYNC_COOKIE_FILE) is specified, the\n            associated cookies can contain authentication information.\n\n    github app\n           When --github-app-private-key-file ($GITSYNC_GITHUB_APP_PRIVATE_KEY_FILE),\n           --github-app-application-id ($GITSYNC_GITHUB_APP_APPLICATION_ID) or\n           --github-app-client-id ($GITSYNC_GITHUB_APP_CLIENT_ID)\n           and --github-app-installation_id ($GITSYNC_GITHUB_APP_INSTALLATION_ID)\n           are specified, GitHub app authentication will be used.\n\n           These credentials are used to request a short-lived token which\n           is used for authentication. The base URL of the GitHub request made\n           to retrieve the token can also be specified via\n           --github-base-url ($GITSYNC_GITHUB_BASE_URL), which defaults to\n           https://api.github.com/.\n\n           The GitHub app must have sufficient access to the repository to sync.\n           It should be installed to the repository or organization containing\n           the repository, and given read access (see github docs).\n\nHOOKS\n\n    Webhooks and exechooks are executed asynchronously from the main git-sync\n    process.  If a --webhook-url or --exechook-command is configured, they will\n    be invoked whenever a new hash is synced, including when git-sync starts up\n    and find that the --root directory already has the correct hash.  For\n    exechook, that means the command is exec()'ed, and for webhooks that means\n    an HTTP request is sent using the method defined in --webhook-method.\n    Git-sync will retry both forms of hooks until they succeed (exit code 0 for\n    exechooks, or --webhook-success-status for webhooks).  If unsuccessful,\n    git-sync will wait --exechook-backoff or --webhook-backoff (as appropriate)\n    before re-trying the hook.  Git-sync does not ensure that hooks are invoked\n    exactly once, so hooks must be idempotent.\n\n    Hooks are not guaranteed to succeed on every single hash change.  For example,\n    if a hook fails and a new hash is synced during the backoff period, the\n    retried hook will fire for the newest hash.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubernetes%2Fgit-sync","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkubernetes%2Fgit-sync","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubernetes%2Fgit-sync/lists"}