{"id":51891898,"url":"https://github.com/marcuwynu23/git-policy","last_synced_at":"2026-07-26T05:01:28.607Z","repository":{"id":368958283,"uuid":"1287681638","full_name":"marcuwynu23/git-policy","owner":"marcuwynu23","description":"Global Git rule management. Install once, protect every local repository.","archived":false,"fork":false,"pushed_at":"2026-07-22T15:21:49.000Z","size":179,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-26T00:14:03.046Z","etag":null,"topics":["git","git-commit","git-policy","local-first","local-iam","local-policy","policy","scm"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/marcuwynu23.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":".github/SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"custom":["https://paypal.me/wynumarcu23"]}},"created_at":"2026-07-02T23:13:34.000Z","updated_at":"2026-07-22T15:23:47.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/marcuwynu23/git-policy","commit_stats":null,"previous_names":["marcuwynu23/git-policy"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/marcuwynu23/git-policy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcuwynu23%2Fgit-policy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcuwynu23%2Fgit-policy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcuwynu23%2Fgit-policy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcuwynu23%2Fgit-policy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/marcuwynu23","download_url":"https://codeload.github.com/marcuwynu23/git-policy/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcuwynu23%2Fgit-policy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35901460,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-26T02:00:06.503Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["git","git-commit","git-policy","local-first","local-iam","local-policy","policy","scm"],"created_at":"2026-07-26T05:01:27.922Z","updated_at":"2026-07-26T05:01:28.600Z","avatar_url":"https://github.com/marcuwynu23.png","language":"Go","funding_links":["https://paypal.me/wynumarcu23"],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cimg title=\"\" src=\"./logo/logo-with-title.svg\" alt=\"\" width=\"208\"\u003e\n\n**Global Git rule management.** Install once, protect every local repository.\n\n[![Go Version](https://img.shields.io/badge/Go-1.25+-00ADD8?logo=go)](https://go.dev)\n[![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)\n[![Platform](https://img.shields.io/badge/platform-Windows%20|%20macOS%20|%20Linux-lightgrey)]()\n[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md)\n[![CI](https://github.com/marcuwynu23/git-policy/actions/workflows/test.yml/badge.svg)](https://github.com/marcuwynu23/git-policy/actions/workflows/test.yml)\n[![codecov](https://codecov.io/gh/marcuwynu23/git-policy/graph/badge.svg)](https://codecov.io/gh/marcuwynu23/git-policy)\n\nNo per-repository setup. No repository-based Git hooks to configure. No CI dependency.\nJust one global install and every repository on your machine is protected.\n\n\u003c/div\u003e\n\n---\n\n```bash\ngit policy install   # one-time setup\ngit add .env\ngit commit -m \"test\" # ← blocked automatically\n```\n\n## Why git-policy?\n\nEvery developer has accidentally committed something they shouldn't:\n\n- A `.env` file with database credentials\n- An AWS secret key hardcoded in a config file\n- A 200MB binary that bloats the repository forever\n- A commit directly to `main` or `production`\n- A sloppy commit message like `\"fixed stuff\"`\n\nExisting tools like **Husky**, **Lefthook**, and **pre-commit** solve this —\nbut only if you configure them **in every single repository**.\n\ngit-policy flips the model: **install once globally**, and rules apply\nto every repository you work on. Zero setup per project. Zero CI configuration.\n\n### How it's different\n\n|                         | git-policy             | Husky              | Lefthook             | pre-commit                |\n| ----------------------- | ---------------------- | ------------------ | -------------------- | ------------------------- |\n| Install once globally   | Yes                    | No                 | No                   | No                        |\n| Per-repository setup needed   | **None**               | npm install + init | config file per repository | `.pre-commit-config.yaml` |\n| Built-in secret scanner | Yes                    | No                 | No                   | Plugin                    |\n| Built-in branch protect | Yes                    | No                 | No                   | No                        |\n| Built-in file blocking  | Yes                    | No                 | No                   | No                        |\n| Built-in commit lint    | Yes                    | Plugin             | Script               | Plugin                    |\n| Cross-platform          | Yes                    | Yes                | Yes                  | Yes                       |\n| Written in              | **Go** (static binary) | JS                 | Ruby                 | Python                    |\n\n---\n\n## Use Cases\n\n### Solo Developer\n\nYou work on 10+ projects. You don't want to set up hooks in each one.\nInstall git-policy once. Every `git commit` is checked automatically.\nNo configuration files scattered across your projects.\n\n### Engineering Team\n\nYour team has standards: conventional commits, no secrets in code,\nno direct pushes to production. Share one YAML config file.\nEvery developer runs `git-policy install` once on their machine.\nEnforcement happens locally, before code ever reaches CI.\n\n### Open Source Maintainer\n\nContributors come and go. You can't enforce that everyone installs\na specific tool. With global git-policy, at least **you** are protected\nfrom accidental secret leaks or bad commits, regardless of which\nproject you're working on.\n\n### DevOps / CI/CD Teams\n\ngit-policy **shifts left** — it catches rule violations on the\ndeveloper's machine _before_ code ever reaches CI/CD, the cloud,\nor a code review.\n\n```mermaid\nflowchart LR\n    A[Developer commit] --\u003e B{git-policy}\n    B --\u003e|Pass| C[git push]\n    B --\u003e|Block| D[Fix locally]\n    C --\u003e E{CI/CD Pipeline}\n    E --\u003e|Pass| F[Deploy to Cloud]\n    D --\u003e A\n```\n\nWithout git-policy, secret leaks or bad commits are only caught\nmid-pipeline — wasting CI minutes, clogging logs, and slowing\ndown the team. With git-policy, issues are blocked **instantly**\nat the one place they're cheapest to fix: the developer's keyboard.\n\n**What this means for DevOps:**\n\n- **Fewer failed CI runs** — secrets, large files, and bad messages\n  are filtered before `git push`\n- **Less noise in CloudWatch / Datadog / alerts** — no accidental\n  credentials making it to the repository\n- **Faster feedback loop** — developer knows in \u003c 100ms instead\n  of waiting 5-15 minutes for a CI job\n- **No CI dependency** — rules work offline, on a plane, in\n  an airgapped environment\n\n---\n\n## How It Works\n\n```mermaid\nflowchart LR\n    A[git commit] --\u003e B[git-policy run]\n    B --\u003e C{All rules pass?}\n    C --\u003e|Yes| D[✅ Commit proceeds]\n    C --\u003e|No| E[❌ Commit blocked]\n```\n\n---\n\n## Built-in Rules\n\n| Rule                 | What it does                                                                                            |\n| -------------------- | ------------------------------------------------------------------------------------------------------- |\n| **BlockFiles**       | Prevents committing `.env`, `*.pem`, `*.key`, `*.p12`, `*.crt` (configurable)                           |\n| **SecretScan**       | Detects AWS keys, GitHub tokens, OpenAI keys, Stripe keys, Slack tokens, JWTs, and more in staged files |\n| **BranchProtection** | Blocks direct commits to `main`, `master`, `production` (configurable)                                  |\n| **CommitMessage**    | Enforces conventional commits: `feat:`, `fix:`, `docs:`, `test:`, etc.                                  |\n| **FileSize**         | Rejects files larger than the configured limit (default 10MB)                                           |\n| **BinaryFile**       | Blocks `.exe`, `.dll`, `.so`, `.iso`, `.zip` from being committed                                       |\n\nEach rule can be enabled/disabled individually via the CLI or config file.\n\n---\n\n## Quick Start\n\n```bash\n# 1. Install\ngit clone https://github.com/marcuwynu23/git-policy\ncd git-policy\nmake dev\n\n# 2. Verify\ngit policy doctor\n\n# 3. See active rules\ngit policy rule list\n\n# 4. It just works — try it\nmkdir test-repository \u0026\u0026 cd test-repository\ngit init\necho \"secret=abc\" \u003e .env\ngit add .env\ngit commit -m \"test\"    # ← blocked by BlockFiles rule\n```\n\nFor detailed usage, see [USER-GUIDE.md](USER-GUIDE.md).\n\n---\n\n## Commands at a Glance\n\n| Command                            | What it does                                      |\n| -----------------------------------| ------------------------------------------------- |\n| `install`                          | Install global hooks (one-time)                    |\n| `uninstall`                        | Remove hooks (keeps config)                        |\n| `uninstall --all`                  | Remove hooks + config entirely                     |\n| `run`                              | Run rules against current repository               |\n| `history`                          | Show git-policy run history                        |\n| `doctor`                           | Check if git-policy is set up correctly            |\n| `validate`                         | Check if config is valid                           |\n| `rule list`                        | Show all rules and on/off status                   |\n| `rule enable \u003cname\u003e`               | Turn a rule on                                     |\n| `rule disable \u003cname\u003e`              | Turn a rule off                                    |\n| `rule skip [name...]`              | Skip a rule for the current commit (auto-clears)   |\n| `rule skip --list`                 | Show currently skipped rules                       |\n| `rule skip --clear`                | Clear all skipped rules                            |\n| `rule add \u003cname\u003e`                  | Add a custom rule (--type, --pattern, --message)   |\n| `rule remove \u003cname\u003e`               | Remove a custom rule from config                   |\n| `rule export \u003cname\u003e`               | Export a custom rule as a YAML file                |\n| `rule import \u003cfile\u003e`               | Import a custom rule from a YAML file              |\n| `plugins install \u003cfile\u003e`           | Install a plugin from a YAML descriptor            |\n| `plugins install --disabled \u003cfile\u003e`| Install with rules disabled by default             |\n| `plugins uninstall \u003cname\u003e`         | Remove a plugin and its descriptor file from disk  |\n| `plugins list`                     | List installed plugins with file paths             |\n\n\u003e `policy` may be used in place of `rule` (e.g. `git-policy policy list`) as an accepted alias.\n\n---\n\n## Example Workflow\n\n```bash\n# Developer clones a project — git-policy is already active\ngit clone https://github.com/team/project\ncd project\n\n# Accidentally stage a .env file\necho \"DB_PASSWORD=secret\" \u003e .env\ngit add .env\ngit commit -m \"add config\"\n\n# BLOCKED: BlockFiles - .env detected\n# Fix: Remove .env from staging or add it to .gitignore\n\n# Developer fixes\necho \"DB_PASSWORD=secret\" \u003e .env.example\ngit add .env.example\ngit commit -m \"feat: add env example\"\n# PASS: All policies passed\n```\n\n---\n\n## Limitations\n\n- **No per-repository overrides** — policies are global only. You can't have\n  different rules for different projects yet.\n- **No custom rules** — the plugin system is not implemented. You're\n  limited to the 6 built-in rules.\n- **No remote sync** — team policy distribution via Git repository or HTTP\n  endpoint is planned but not available.\n- **No pre-push rules** — the pre-push hook runs policies but there\n  are no push-specific checks (e.g., blocking force push).\n- **No GUI** — CLI only.\n- **No Windows native hooks** — hooks run via Git Bash (shipped with\n  Git for Windows). No PowerShell-based hooks.\n\nThese are all on the roadmap.\n\n---\n\n## Documentation\n\n| Resource                               | What's in it                                                        |\n| -------------------------------------- | ------------------------------------------------------------------- |\n| **[USER-GUIDE.md](USER-GUIDE.md)**     | Full usage guide, configuration reference, testing, troubleshooting |\n| **[CONTRIBUTING.md](CONTRIBUTING.md)** | Building, testing, adding rules, code standards                     |\n| **[MAINTAINERS.md](MAINTAINERS.md)**   | Project maintainers                                                 |\n| **[CONTRIBUTORS.md](CONTRIBUTORS.md)** | List of contributors                                                |\n\n---\n\n## Community\n\n- [Code of Conduct](CODE_OF_CONDUCT.md) — expectations for contributors\n- [Security Policy](SECURITY.md) — how to report vulnerabilities\n- [Support Guide](.github/SUPPORT.md) — where to get help\n- [Issue Template](.github/ISSUE_TEMPLATE/) — templates for reporting bugs or feature requests\n- [Pull Request Template](.github/PULL_REQUEST_TEMPLATE.md) — PR guidelines\n\n---\n\n## License\n\nApache 2.0 — chosen for its patent protection and compatibility with\nthe open-source ecosystem. Contributions are accepted under the same\nlicense.\n\nHappy coding!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmarcuwynu23%2Fgit-policy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmarcuwynu23%2Fgit-policy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmarcuwynu23%2Fgit-policy/lists"}