Git & GitHub Mastery · Chapter 35
References
46 min read · Volume 4 of 4: Scale, professional practice, production, and reference
Contents
Source file: reference/references.md
References
Baseline. Sources as cited on 1 October 2026 for Git 2.55.0 (2.56.0 where a chapter says so) and for GitHub. This file is the "Sources" section of every chapter, collected in the order of the modules. No source was added: every link, date, caveat and video below stands in a chapter, and the chapters took them from the Phase 0 research report, its research notes, the local manual pages, or official pages fetched while the chapter was written.
How to use this list
- Primary sources are the Git manual pages and source, GitHub's documentation and changelog, and the tools' own repositories. When a chapter and a primary source disagree, the primary source for your version wins: on your machine,
git help <command>is the manual of the Git you run. - Secondary sources are books, blog posts and surveys. Each carries the caveat its chapter gave it (age, sample, vendor interest).
- Videos are optional and come only from the tables of the Phase 0 report. The assessments there rest on captions and chapter lists, not on full viewing, and several videos predate
git switchandgit restoreor assume a branch calledmaster; the note beside each video says so. - Further reading points to other chapters and to deeper material.
GitHub-side facts carry dates because the platform changes: before you rely on a limit, a price, a plan gate or a label, open the linked page. The re-verification calendar is section 10 of the roadmap.
Module index
| Modules | Chapters |
|---|---|
| Modules 0 and 1: what Git is, the mental model | Chapter 1: Fundamentals, Chapter 2: The Mental Model |
| Module 2: working tree, index, HEAD | Chapter 4: The Working Tree, Chapter 5: The Index |
| Module 3: commits | Chapter 6: Commits |
| Module 4: refs, branches, HEAD | Chapter 7: Branches |
| Modules 5, 13 and 24 (local part): configuration, tags and versions, signing | Chapter 14B: Configuration, Aliases, Tags and Signing |
| Module 6: merge | Chapter 8: Merge |
| Module 7: remotes | Chapter 12: Remote Operations |
| Module 8: undo | Chapter 11: Reset, Revert, Restore |
| Module 9: rebase | Chapter 9: Rebase |
| Module 10: cherry-pick and ranges | Chapter 10: Cherry-pick |
| Modules 10 (ranges) and 11: history forensics | Chapter 14A: History investigation |
| Module 12: recovery | Chapter 13: Recovery |
| Module 14: hooks, rerere, attributes, worktrees | Chapter 14C: Stash Internals, Rerere, Attributes, Hooks, Chapter 25: Worktrees |
| Module 15: submodules, subtrees, LFS | Chapter 22: Git LFS, Chapter 23: Submodules and Subtrees |
| Modules 16 and 17: the object database, the index, refs and the Git directory | Chapter 3: Git Internals |
| Modules 16 and 18: maintenance, transfer and scale | Chapter 26: Performance, Chapter 24: Monorepos |
| Modules 19 and 25: the GitHub platform, the CLI and the API | Chapter 15: GitHub |
| Module 20: authentication and SSH | Chapter 16: Authentication |
| Modules 21 and 22: pull requests, forks, merge methods, releases | Chapter 17: Pull Requests |
| Module 23: governance | Chapter 18: Branch Protection and Rulesets, Chapter 19: CODEOWNERS |
| Module 26: Actions fundamentals | Chapter 20A: GitHub Actions Fundamentals |
| Modules 27 and 28: build, package, deliver; runners and debugging CI | Chapter 20B: GitHub Actions: delivery, runners, cost and debugging |
| Module 29: Actions security | Chapter 21A: GitHub Actions security |
| Modules 24 (GitHub part), 30 and 31: repository security and secret-leak response | Chapter 21B: Repository security, identity, the Git client, and secret-leak response |
| Modules 32 and 34: branching and release strategy, practices and design review | Chapter 27: Open source and team workflows |
| Module 33: AI/ML workflows | Chapter 28: AI/ML workflows |
| Module 35: the diagnosis method | Chapter 29: Production Troubleshooting |
| Modules 36 to 38: incident drills, communication and postmortems | Chapter 30: Incident Response |
| Module 42: the frontier | Chapter 14D: The Frontier |
Modules 0 and 1: what Git is, the mental model
Chapter 1: Fundamentals
From section 1.19 of Chapter 1: Fundamentals.
Primary sources
- git(1) (external site): description, environment variables,
--no-optional-locks. - gitrepository-layout (external site): every file in
.git. - gitglossary (external site): bare repository, unborn branch, plumbing, porcelain.
- gitdatamodel (external site): the official data model page, on your machine as
git help datamodel. - git-init (external site), git-status (external site), git-config (external site), git-rev-parse (external site), git-ls-files (external site), git-rm (external site).
- Git source at the v2.55.0 tag: builtin/rm.c (external site), submodule.c (external site) and builtin/fsck.c (external site), read for the two root-cause notes in sections 1.7 and 1.13.
- Pro Git, second edition: About Version Control (external site), A Short History of Git (external site), What is Git? (external site). The book is hosted on the official site and has been frozen since May 2024, so its command style is older than this chapter's.
- GitHub: changelog entry on CLI telemetry (external site), gh environment variables (external site).
Secondary sources
- Phase 0 research report, sections 1, 2, 4 and 12: versions, dates, the two Gits, and the Git and GitHub layers, each with a link to its primary source.
Videos
The report assessed these from captions and chapter lists, not by full viewing.
- "Learn Git & GitHub for Beginners (2026) Tutorial" (external site), Coder Coder, 56 minutes, 28 June 2026. Current commands, including
git switchandgit restore. Beginner scope only. - "Git Tutorial for Beginners: Learn Git in One Video" (external site), CodeWithHarry, Hindi, 2 hours 32 minutes, 12 July 2026. Current commands. It teaches no reset, revert or reflog, uses a local
master, and first calls a branch a copy before correcting that to a pointer. - "Tech Talk: Linus Torvalds on git" (external site), 2007, and "Two decades of Git" (external site), 2025. Design intent and history. Polemical; his 2025 remark that the SHA-256 work was needless churn is his opinion, not the project's position.
Further reading
- gittutorial (external site) and giteveryday (external site), also available as
git help tutorialandgit help everyday. - The Git User's Manual (external site).
Chapter 2: The Mental Model
From section 2.19 of Chapter 2: The Mental Model.
Primary sources
- gitdatamodel (external site): objects, refs, the index and reflogs; on your machine as
git help datamodel. - gitglossary (external site): DAG, reachable, dangling object, HEAD, ref, symref.
- gitrevisions (external site):
<rev>^{tree},<rev>:<path>,:<path>, and the lookup order of a short ref name. - Manual pages: git-hash-object (external site), git-update-index (external site), git-write-tree (external site), git-commit-tree (external site), git-update-ref (external site), git-cat-file (external site), git-ls-tree (external site), git-fsck (external site), git-patch-id (external site), git-cherry-pick (external site).
- Git source at the v2.55.0 tag: refs.c (external site), read for the root-cause box in section 2.13.
- Pro Git, second edition, chapter 10: Git Objects (external site), Git References (external site). Frozen since May 2024; the object model is current, the commands use
masterandgit checkout. - GitHub Docs: pull requests reference (external site), removing sensitive data from a repository (external site).
Secondary sources
- Phase 0 research report: section 12 for the misconceptions, sections 1 and 4 for versions.
- Julia Evans: how cherry-pick and revert work (external site), branches: intuition and reality (external site), confusing Git terminology (external site), poll results (external site). The polls are self-selected samples: direction, not population figures.
Videos
The report assessed these from caption searches, chapter lists and descriptions, not by full viewing.
- "Lecture 5: Version Control and Git" (external site), MIT Missing Semester 2026, 1 hour 10 minutes, 19 February 2026, with notes and exercises (external site). The data model before the commands. SHA-1 only; the demo starts on
master; nothing on GitHub. - "Git Internals by John Britton of GitHub - CS50 Tech Talk" (external site), 58 minutes, 11 April 2018. Blobs, trees, commits, hashing, refs as files. Correct and clear;
master,git checkout, SHA-1 only. - "Complete git and Github course in Hindi" (external site), Chai aur Code, Hindi, 2 hours 55 minutes, 8 June 2024, from 55:16. Commit, tree and blob by name; HEAD as a pointer to the current branch. Local
master; no revert, restore or cherry-pick.
Further reading
- gitcore-tutorial (external site), the Git project's own walk through the plumbing, and The Git User's Manual (external site).
Module 2: working tree, index, HEAD
Chapter 4: The Working Tree
From section 4.21 of Chapter 4: The Working Tree.
Primary sources
- git-status (external site), gitignore (external site), git-check-ignore (external site), git-restore (external site), git-rm (external site), git-mv (external site), git-clean (external site), git-ls-files (external site), git-checkout (external site), git-diff (external site), git-config (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text that the transcripts were checked against. - gitfaq (external site): "I asked Git to ignore various files, yet they are still tracked" and "Why do I have a file that's always modified?".
- gitglossary (external site) and gitattributes (external site).
- Git User's Manual (external site): renames are not recorded; only the executable bit is.
- Release notes: 2.23.0 (external site), 2.51.0 (external site), and 1.8.2 and 1.8.5 as shipped with Git 2.55.0 (
Documentation/RelNotes/in the Git source tree).
Secondary sources
- Pro Git, Recording Changes to the Repository (external site). Caveat: its status transcripts mix the current
git restore --stagedhint with the oldergit reset HEAD <file>hint. - GitHub Docs, Ignoring files (external site), and the github/gitignore (external site) template collection.
- GitHub Docs, Removing sensitive data from a repository (external site), for what a committed secret requires beyond
git rm --cached. - Perez De Rosso and Jackson, Purposes, Concepts, Misfits, and a Redesign of Git (external site) (OOPSLA 2016): file tracking, untracking a file, file rename and empty directory are four of its seven "operational misfits".
- The Phase 0 report of this course, sections 4, 12 and 15, for the Stack Overflow figures and the ML ignore list.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Git Tutorial for Beginners: Learn Git in One Video (external site), CodeWithHarry, Hindi, 12 July 2026: covers staging, ignoring files and tracking empty directories with
git restore --staged. Caveats from the report: no reset, revert or reflog; localmaster; an early "branch is a copy" phrase that the video corrects later. - How to Undo Mistakes With Git Using the Command Line (external site), Tobias Günther for freeCodeCamp, 24 November 2020:
git restore, including-p. Caveat:masternaming.
Further reading
- git-update-index (external site), section "Untracked cache", and the "Untracked files and performance" section of git-status, for why status is slow in very large working trees. Chapter 26 (Performance) continues from there.
Chapter 5: The Index
From section 5.22 of Chapter 5: The Index.
Primary sources
- git-add (external site), git-diff (external site), git-commit (external site), git-restore (external site), git-reset (external site), git-rm (external site), git-ls-files (external site), git-update-index (external site), git-checkout-index (external site), git-write-tree (external site), git-diff-files (external site), git-status (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text used for the transcripts. - gitdatamodel (external site), gitformat-index (external site), gitrevisions (external site) and gitfaq (external site) ("How do I ignore changes to a tracked file?").
- racy-git (external site): the cached stat data and its one known weakness. lockfile.h (external site): the lock-file protocol.
- Release notes 2.0.0 (external site), 1.6.1 (external site), 2.11.0 (external site), 2.19.0 (external site); 1.5.4 and 2.38.0 as shipped with Git 2.55.0.
Secondary sources
- Pro Git, Interactive Staging (external site). Caveat: its prompt and its
git stash save --patchcome from an older Git. - Pro Git, Reset Demystified (external site): the three trees, with the index as "your proposed next commit". Caveat: it says "working directory" for the working tree.
- The Phase 0 report of this course, sections 11 and 12: the Stack Overflow figure and the survey of ten beginner resources (outline-based; transcripts were not reviewed).
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Lecture 5: Version Control and Git (external site), MIT Missing Semester 2026: the staging area as part of the data model; the notes (external site) list
add -p. Caveats: describes object IDs as SHA-1 only; the demo starts onmaster. - Git for Professionals (external site), Tobias Günther for freeCodeCamp, September 2021: commit craft with
git add -p. Caveat: 2021 interface.
Further reading
- git-sparse-checkout (external site), the feature that the skip-worktree bit was built for.
Module 3: commits
Chapter 6: Commits
From section 6.19 of Chapter 6: Commits.
Primary sources
- git-commit (external site), git-show (external site), git-log (external site), git-cat-file (external site), git-commit-tree (external site), git-interpret-trailers (external site), git-shortlog (external site), git-var (external site), git-am (external site), git-gc (external site), githooks (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text that the transcripts were checked against. - gitdatamodel (external site), gitrevisions (external site), gitformat-signature (external site).
- The Git project's SubmittingPatches (external site): separate commits, the message, sign-off and trailers. trailer.c at 2.55.0 (external site) for the trailers Git generates.
- Release notes 2.29 (external site), 2.32 (external site) and 2.56 (external site).
- GitHub Docs: troubleshooting commits (external site), creating a commit with multiple authors (external site), setting your commit email address (external site), about commit signature verification (external site).
Secondary sources
- Pro Git, Git Internals: Git Objects (external site) and the commit guidelines in Contributing to a Project (external site). Caveat: both use
master. - Chris Beams, How to Write a Git Commit Message (external site) (2014): the widely quoted seven rules.
- Conventional Commits 1.0.0 (external site), a title convention whose footers follow the trailer format.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Lecture 5: Version Control and Git (external site), MIT Missing Semester 2026: snapshots, history as a graph, content-addressed objects. Caveats: describes object IDs as SHA-1 only; the demo starts on
master. - RubyConf 2018 - Branch in Time (external site), Tekin Süleyman: why history quality matters, told as one story. Nothing in it depends on a Git version.
- How to Undo Mistakes With Git Using the Command Line (external site), Tobias Günther for freeCodeCamp, 2020: includes amend. Caveat:
masternaming.
Further reading
- Chapter 9, section 9.3, and Chapter 10, section 10.3: the "new object, new ID" rule applied to rebase and cherry-pick.
Module 4: refs, branches, HEAD
Chapter 7: Branches
From section 7.20 of Chapter 7: Branches.
Primary sources
- git-branch (external site), git-switch (external site), git-checkout (external site) ("Detached HEAD"), git-symbolic-ref (external site), git-update-ref (external site), git-for-each-ref (external site), git-rev-parse (external site), git-merge-base (external site), git-rev-list (external site), git-tag (external site), git-check-ref-format (external site), git-pack-refs (external site), git-merge-tree (external site), git-fetch (external site), git-clone (external site), git-worktree (external site), git-submodule (external site), git-config (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text that the transcripts were checked against. - gitrevisions (external site), gitglossary (external site), gitdatamodel (external site).
- Git source at 2.55.0, wt-status.c (external site), for how
git statuschooses "detached at", "detached from" and "Not currently on any branch". - git-branch at 2.56.0 (external site) and release notes 2.22 (external site), 2.23 (external site), 2.47 (external site), 2.51 (external site), 2.55 (external site), 2.56 (external site).
- GitHub Docs: pull requests reference (external site), events that trigger workflows (external site).
Secondary sources
- Pro Git, Branches in a Nutshell (external site) and Git References (external site). Caveats:
masterthroughout, and branch switching withgit checkout. - Julia Evans, git branches: intuition & reality (external site) and how HEAD works in git (external site); the 2024 poll results (external site) quoted in section 7.1.
- The Phase 0 report of this course, sections 1 and 12, for the reftable rationale and the misconception table.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Git Internals by John Britton of GitHub - CS50 Tech Talk (external site), 2018: refs as files holding an ID, branches as pointers. Caveats:
masterandcheckout; SHA-1 only. - Git For Beginners (external site), Telusko, 2023: asks whether a branch copies the project and explains why it does not. Caveat: no undo or rebase.
- Intern DELETED a Git Branch! (external site), Chai aur Code, Hindi, 2026: recovering a deleted branch through the reflog. Caveat: a single scenario.
Outdated advice. Several popular tutorials introduce a branch as a copy of the project and HEAD as the latest commit; the report lists Apna College's 2023 tutorial (external site) among them. Both statements fail the transcripts of sections 7.2 and 7.3.
Further reading
- Chapter 8, section 8.2, for merge bases with more than one candidate; Chapter 12 for everything about
origin/; Chapter 13 for the reflog as a recovery tool.
Modules 5, 13 and 24 (local part): configuration, tags and versions, signing
Chapter 14B: Configuration, Aliases, Tags and Signing
From section 14B.25 of Chapter 14B: Configuration, Aliases, Tags and Signing.
Primary sources
- git-config (external site), git (external site), git-var (external site), gitcredentials (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text the transcripts were checked against. - git-tag (external site) (including "On Re-tagging"), git-describe (external site), git-for-each-ref (external site), git-check-ref-format (external site), git-push (external site), git-fetch (external site), gitworkflows (external site), githooks (external site).
- gitformat-signature (external site), git-verify-commit (external site), git-verify-tag (external site), git-log (external site) (pretty formats), git-merge (external site), the gpg configuration reference (external site), and ssh-keygen(1) (external site), "ALLOWED SIGNERS".
- Git source at 2.55.0, read for behavior the manual does not state: receive-pack.c (external site) (the
receive.deny*settings apply torefs/heads/only), http.c (external site) (GIT_CURL_VERBOSE), editor.c (external site) (VISUALand dumb terminals). - Release notes 2.34 (external site), 2.45 (external site), 2.46 (external site), 2.49 (external site), 2.54 (external site), 2.56 (external site).
- Semantic Versioning 2.0.0 (external site).
- GitHub Docs: about commit signature verification (external site), telling Git about your signing key (external site), about releases (external site), associating text editors with Git (external site).
Secondary sources
- Pro Git: Git Configuration (external site), Git Aliases (external site), Tagging (external site), Signing Your Work (external site), Environment Variables (external site). Caveats: legacy
git configsyntax, GPG only,master. - Julia Evans, Popular git config options (external site) (2024): a crowd-sourced list that overlaps the table in section 14B.5.
- Taylor Blau, Highlights from Git 2.34 (external site): the introduction of SSH signing.
- Russ Cox, the xz attack timeline (external site); Gruntwork, How to spoof any user on GitHub (external site).
Videos
(optional; assessments in the Phase 0 report rest on captions and chapter lists, not on full viewing)
- So You Think You Know Git - FOSDEM 2024 (external site), Scott Chacon, 47 minutes:
includeIfat 08:23, SSH signing and the "Verified" badge from 19:00. Caveats: a survey, not a deep dive; about one minute of product pitch. - Simplify signing Git commits and tags with SSH keys (external site), Andy Feller, Git Merge 2022 workshop, 56 minutes. Caveat: assessed from automatic captions and the description.
- Tag, You're Leaked: Surviving the tj-actions Supply Chain Attack (external site), BSides PDX 2025, 24 minutes: what a moved tag costs at scale.
Further reading
- The "DISCUSSION" section of git-tag(1): three short essays on re-tagging, tag following and backdating.
Module 6: merge
Chapter 8: Merge
From section 8.25 of Chapter 8: Merge.
Primary sources
- git-merge (external site), git-merge-base (external site), git-merge-tree (external site), git-merge-file (external site), git-read-tree (external site), gitrevisions (external site), git-status (external site), git-restore (external site), git-checkout (external site), git-log (external site), git-diff (external site), git-revert (external site), git-rerere (external site), gitattributes (external site), gitglossary (external site), gitfaq (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text that every quotation and transcript was checked against. - Git source and documentation at fixed tags: merge strategies (external site), merge configuration (external site), git-add at 2.56 (external site), builtin/merge.c at 2.55 (external site).
- Release notes: 2.34 (external site), 2.35 (external site), 2.36 (external site), 2.38 (external site), 2.50 (external site), 2.56 (external site).
- GitHub: Pull request merges (external site), Events that trigger workflows (external site), changelog of 12 September 2022 (external site), Scaling merge-ort across GitHub (external site) (27 July 2023).
Secondary sources
- Pro Git, Basic Branching and Merging (external site) and Advanced Merging (external site). Caveat: see the "Outdated advice" note in section 8.22.
- Julia Evans, Git poll results (external site) (2024). Self-selected samples.
- nbdime (external site) documentation, for notebook diffs and merges.
- The Phase 0 report of this course, sections 1, 4, 12 and 13.
Videos
(optional; the assessments in the Phase 0 report rest on captions and chapter lists, not on full viewing)
- David Mahler, "Branching and Merging" (external site) (29 min, 2017). Fast-forward against three-way merges drawn on the commit graph. Conceptually excellent; uses
masterand the commands that predategit restore. - ThePrimeagen for Boot.dev, "Git and GitHub - Full Course" (external site) (2024): merge from 1:03:27, merge conflicts from 2:41:25. Current commands; a digressive commentary style.
- Elijah Newren, the author of
ort, at Git Merge 2022 (external site) and 2025 (external site): the merge backend and--remerge-diff. Contributor level; watch after this chapter.
Further reading
- Chapter 9 for the other way to integrate, Chapter 11 for undoing merges, Chapter 14C for rerere and merge drivers, Chapter 17 for merge methods on GitHub.
Module 7: remotes
Chapter 12: Remote Operations
From section 12.21 of Chapter 12: Remote Operations.
Primary sources
- git-clone (external site), git-fetch (external site), git-pull (external site), git-push (external site), git-remote (external site), git-ls-remote (external site), git-branch (external site), git-merge-base (external site) (fork point), git-receive-pack (external site), git-bundle (external site), git-url-parse (external site), gitrevisions (external site), gitglossary (external site), gitdatamodel (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text that every flag in this chapter was checked against. - gitprotocol-v2 (external site) and gitprotocol-pack (external site): the fetch and push conversations of section 12.13, including "wants can be anything".
- Configuration reference at 2.56: push (external site), pull (external site), fetch (external site), core (external site).
- Release notes: 1.8.3 (external site), 1.8.4 (external site), 1.8.5 (external site), 2.0.0 (external site), 2.4.0 (external site), 2.5.0 (external site), 2.20.0 (external site), 2.26.0 (external site), 2.29.0 (external site), 2.34.0 (external site), 2.48.0 (external site), 2.54.0 (external site), 2.55.0 (external site). Homebrew installs the same files under
share/doc/git-doc/RelNotes/.
Secondary sources
- Pro Git: Working with Remotes (external site), Remote Branches (external site), The Refspec (external site), Transfer Protocols (external site). Caveats:
masterandgit checkoutthroughout; the first still says thatgit pullonly warns whenpull.rebaseis unset, which was true from 2.27 to 2.33.0; the last does not mention protocol version 2. - GitHub Docs: About remote repositories (external site), Forks (external site), Syncing a fork (external site), Checking out pull requests locally (external site), Renaming a branch (external site), Troubleshooting commits (external site).
- Julia Evans, Confusing git terminology (external site), cited by the Phase 0 report for what "Your branch is up to date with 'origin/main'" does and does not say.
- The Phase 0 report of this course, sections 1, 4, 12 and 13, for the dated defaults, the misconception table and the force-push safety facts.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Introduction to Git - Remotes (external site), David Mahler, 31 minutes, 27 March 2018: clone, fetch versus pull and tracking branches drawn on the commit graph. Caveat:
masterthroughout. - Git and GitHub - Full Course (external site), ThePrimeagen for Boot.dev, 12 November 2024: the chapter on remotes and GitHub starts at 1:54:18, followed by forks. Caveat: digressive style.
- Complete Git and GitHub Tutorial (external site), Kunal Kushwaha, 1 August 2021: fork, upstream remote, keeping a fork in sync. Caveats from the report: recorded days before password removal, uses a plain force push, mixes
masterandmain, and could not be transcript-audited.
Further reading
- gitprotocol-http (external site), for what "smart HTTP" does with the conversation of section 12.13.
- git-maintenance (external site), task
prefetch: Git's own scheduled fetch writes torefs/prefetch/so that it does not move remote-tracking branches, and therefore does not renew a lease. - Chapter 13 (Recovery) for reflogs and
git fsck, Chapter 26 (Performance) for shallow and partial clones and bundle URIs, and Chapter 30 (Incident response) for the force-push drill.
Module 8: undo
Chapter 11: Reset, Revert, Restore
From section 11.20 of Chapter 11: Reset, Revert, Restore.
Primary sources
- git-reset (external site) (with the tables in its "Discussion" section), git-revert (external site), git-restore (external site), git-clean (external site), git-stash (external site), git-commit (external site), git-rebase (external site), git-fsck (external site), git-config (external site), gitrevisions (external site) and git(1) (external site). The transcripts were checked against the local Git 2.55.0 copies (
git help -m <command>). - How to revert a faulty merge (external site), the how-to that the revert manual points to.
- gitfaq (external site), the entries on undoing a change that is already in the main branch and on a change reverted on one of two branches.
- Release notes 2.23.0 (external site), 2.35.0 (external site), 2.43.0 (external site), 2.51.0 (external site), and 1.7.1 as shipped with Git 2.55.0 (directory
RelNotesunder the path thatgit --html-pathprints). - GitHub Docs: Reverting a pull request (external site) and Available rules for rulesets (external site); GitHub CLI manual, gh pr revert (external site).
Secondary sources
- Julia Evans, How git cherry-pick and revert use 3-way merge (external site).
- Pro Git, Reset Demystified (external site). Caveat: it contrasts
resetwithgit checkoutand does not mentiongit restore. - Pro Git, Undoing Things (external site) (old and new spellings side by side) and Stashing and Cleaning (external site). Caveat: the stash chapter mostly uses bare
git stashand does not cover--staged. - The Phase 0 report of this course, sections 4, 12 and 13, for the Stack Overflow figures and the retention defaults.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- How to Undo Mistakes With Git Using the Command Line (external site), Tobias Günther for freeCodeCamp, 55 minutes, 24 November 2020:
git restoreincluding-p, amend, revert, reset, reflog recovery from 24:02. Caveat:masternaming. - Revert and Reset Commits Like a Pro (external site), ProCodrr episode 6, Hindi, 56 minutes, March 2023: reset versus revert, with reflog recovery of a hard-reset commit. Caveat:
master.
Further reading
- Oh Shit, Git!?! (external site), a short scenario list. Caveat: it uses the
checkoutandresetspellings.
Module 9: rebase
Chapter 9: Rebase
From section 9.27 of Chapter 9: Rebase.
Primary sources
- git-rebase (external site), including its sections "Behavioral differences", "Recovering from upstream rebase" and "Rebasing merges"; git-range-diff (external site); git-push (external site); git-pull (external site); git-commit (external site) for
--fixupand--squash; git-cherry (external site); git-patch-id (external site); gitrevisions (external site) forORIG_HEADandREBASE_HEAD; gitglossary (external site); githooks (external site). The local copies (git help -m <command>) are the Git 2.55.0 text that the transcripts were checked against. - git-replay (external site) and git-history (external site); the pages on git-scm.com describe 2.56.
- Release notes: 2.26.0 (external site), 2.34.0 (external site), 2.38.0 (external site), 2.44.0 (external site), 2.46.0 (external site), 2.54.0 (external site).
- GitHub Docs: about merge methods (external site), pull request merges (external site), available rules for rulesets (external site).
Secondary sources
- Pro Git, Rebasing (external site) and Rewriting History (external site). Caveats:
masterthroughout, andgit checkoutin the first; neither mentions--update-refs,--force-with-leaseorgit range-diff; the second still demonstratesgit filter-branch, with a warning. - Julia Evans, git rebase: what can go wrong? (external site), Confusing git terminology (external site) and Some Git poll results (external site). The polls are self-selected samples.
- git rebase in depth (external site), a sandbox walkthrough. Its author and year could not be confirmed from the page, and it does not cover
exec. - The Phase 0 report of this course, sections 1, 4, 12 and 13.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Philomatics, "git rebase - Why, When & How to fix conflicts" (external site), 10 minutes, June 2024. Current; short and opinionated.
- Tobias Günther for freeCodeCamp, "Advanced Git Tutorial" (external site), 34 minutes, November 2021. Interactive rebase and cherry-pick; mixes
masterandmainand uses somecheckout. - Scott Chacon, "So You Think You Know Git Part 2" (external site), 23 minutes, March 2024. Fixup commits and
--update-refsfor stacked branches. - Colt Steele, "Git Rebase Vs. Merge" (external site), 20 minutes, March 2021. Uses
git switch;masternaming.
Further reading
- Chapter 10 for the single replay that a rebase repeats; Chapter 12 for push and pull; Chapter 13 for reflogs and retention; Chapter 14C for rerere.
Module 10: cherry-pick and ranges
Chapter 10: Cherry-pick
From section 10.18 of Chapter 10: Cherry-pick.
Primary sources
- git-cherry-pick (external site), git-cherry (external site), git-patch-id (external site), git-revert (external site), gitrevisions (external site), gitworkflows (external site), git-commit (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text that the transcripts were checked against; the--cherry-mark,--cherry-pickand--left-rightoptions are described ingit help -m log. - Release notes: 2.45.0 (external site), 2.46.0 (external site), 2.56.0 (external site).
Secondary sources
- Julia Evans, How git cherry-pick and revert use 3-way merge (external site), the clearest short account of the base used by each.
- Derrick Stolee, Commits are snapshots, not diffs (external site) (GitHub Blog, 2020), on how cherry-pick and rebase replay changes although commits store snapshots.
- Branch for release (external site) on trunkbaseddevelopment.com and Microsoft's Release Flow (external site), for the "fix on the main line, then cherry-pick" convention.
- The Phase 0 report of this course, sections 1, 4, 12 and 13.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Tobias Günther for freeCodeCamp, "Advanced Git Tutorial" (external site), 34 minutes, November 2021. Includes cherry-picking; mixes
masterandmain. - ProCodrr, episode 9 on cherry-pick (external site), 8 minutes, March 2023, in Hindi. Mostly current;
masternaming.
Further reading
- Chapter 9, where the same replay runs once per commit; Chapter 11 for revert; Chapter 14A for range notation and
git logas a query language.
Modules 10 (ranges) and 11: history forensics
Chapter 14A: History investigation
From section 14A.31 of Chapter 14A: History investigation.
Primary sources
- git-diff (external site), gitrevisions (external site), git-log (external site), gitdiffcore (external site), git-blame (external site), git-bisect (external site), git-grep (external site), git-shortlog (external site), git-describe (external site), git-config (external site). The local copies (
git help -m <command>) are the Git 2.55.0 text that every option in this chapter was checked against. - Christian Couder, Fighting regressions with git bisect (external site), distributed with Git: the bisection and skip algorithms. The step estimate is in bisect.c at v2.55.0 (external site).
- Release notes: 2.51.0 (external site), 2.52.0 (external site), 2.53.0 (external site), 2.56.0 (external site); BreakingChanges (external site); git-whatchanged (external site); git-last-modified (external site); merge strategies (external site).
- GitHub Docs, described and not run here: three-dot and two-dot comparisons (external site); ignore commits in the blame view (external site).
Secondary sources
- The Phase 0 report of this course, sections 1, 4 and 12: the deprecation table, and the two meanings of the dots among commonly misunderstood topics.
- Julia Evans, Confusing git terminology (external site), cited by the report for several of those misunderstandings.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Tekin Süleyman, "RubyConf 2018 - Branch in Time" (external site), 27 minutes, December 2018. Why history quality matters, told through
git blame,git log -S, interactive rebase and--force-with-lease. Nothing in it depends on a Git version. - ThePrimeagen for Boot.dev, "Git and GitHub - Full Course" (external site), November 2024; the bisect chapter starts at 3:54:53. Current; digressive commentary style.
- glich.stream, "Chad level git: advanced concepts (2025)" (external site), 1 hour 14 minutes, January 2025. Includes bisect, hands-on.
Further reading
- Pro Git, part "Git Tools": Revision Selection (external site), Searching (external site) and Debugging with Git (external site).
- Chapter 5 for the three everyday diffs; Chapter 7 for counting divergence; Chapter 8 for
--remerge-diff; Chapter 9 forgit range-diff; Chapter 10 for patch IDs; Chapter 13 for the reflog as a recovery tool.
Module 12: recovery
Chapter 13: Recovery
From section 13.22 of Chapter 13: Recovery.
Primary sources
- git-reflog (external site), git-fsck (external site), git-gc (external site) (with its NOTES section), git-prune (external site), git-bundle (external site), git-stash (external site) (the recovery recipe in EXAMPLES), git-branch (external site), git-fetch (external site), gitrevisions (external site), git-maintenance (external site), git-pack-objects (external site), git-unpack-objects (external site), gitfaq (external site).
- Configuration reference at the 2.56.0 tag: gc (external site), core (external site), maintenance (external site).
- Git source at the 2.55.0 tag: reflog.c (external site) (the expiry rules and the stash exemption), builtin/stash.c (external site).
- How to recover a corrupted blob object (external site), a how-to in Git's documentation, written in 2007; its method is unchanged.
- Release notes of Git 2.36 (external site) for
git fetch --refetch. - GitHub Docs: Activity view (external site), deleting and restoring branches in a pull request (external site), events API (external site), create a reference (external site), troubleshooting commits (external site).
Secondary sources
- Pro Git, Maintenance and Data Recovery (external site). Caveats: it gives "around 7,000" loose objects as the automatic threshold where the configuration reference says 6700, and it predates cruft packs.
- The Phase 0 report of this course, sections 1, 12 and 13, for the retention defaults, the traced maintenance run and the GitHub instruments.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- How to Rescue Your Commits with Git Reflog (external site), System Crafters, 14 minutes, November 2024: a deleted branch, commits in detached HEAD, a rebase mistake. Caveat:
masterandcheckout. - Intern DELETED a Git Branch! (external site), Chai aur Code, Hindi, 9 minutes, 4 March 2026: a deleted branch recovered through the reflog. A single scenario.
- The BIGGEST Git Mistake Every Intern Makes (external site), Chai aur Code, Hindi, 14 minutes, 4 March 2026: commits on the wrong branch, moved with cherry-pick and reset. A single scenario.
Further reading
- Chapter 30: Incident Response, for the same accidents at team scale, and the disaster-recovery playbook that grows out of the method of section 13.7.
Module 14: hooks, rerere, attributes, worktrees
Chapter 14C: Stash Internals, Rerere, Attributes, Hooks
From section 14C.20 of Chapter 14C: Stash Internals, Rerere, Attributes, Hooks.
Primary sources
- git-stash (external site), git-rerere (external site), gitattributes (external site), git-check-attr (external site), git-archive (external site), git-add (external site), git-restore (external site), githooks (external site), git-hook (external site), git-receive-pack (external site), git-config (external site), git-maintenance (external site), gitfaq (external site) and the security section of git (external site). Every command and option in this chapter was checked against the local Git 2.55.0 copies (
git help -m <command>). - Rerere technical notes (external site) for conflict normalization and conflict IDs; contrib/rerere-train.sh (external site).
- Maintenance configuration (external site) and hook configuration (external site).
- Release notes 2.51.0 (external site), 2.54.0 (external site) and 2.55.0 (external site).
- GitHub Docs: About rulesets (external site), About push protection (external site), About pre-receive hooks (external site) (GitHub Enterprise Server).
- pre-commit (external site), the documentation of the framework, with pre-commit-hooks (external site) and ruff-pre-commit (external site).
Secondary sources
- Pro Git, Git Hooks (external site), Git Attributes (external site) and Rerere (external site). Caveat: the second edition predates
git restore,git hookand configuration-defined hooks, and usesmaster. - The Phase 0 report of this course, sections 1, 4, 14 and 15, for release dates, the hook count, the fail-open argument and the pre-commit facts.
- nbstripout (external site), the tool whose idea the notebook filter of section 14C.8 imitates in twelve lines.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- So You Think You Know Git Part 2 (external site), Scott Chacon, DevWorld 2024, 23 minutes, 20 March 2024: hooks, attributes, smudge and clean filters. Caveat from the report: no depth on hook security.
- So You Think You Know Git (external site), Scott Chacon, FOSDEM 2024, 47 minutes, 8 February 2024: rerere among many other settings. Caveat: a survey, with about one minute of product pitch.
Further reading
- Chapter 8 for conflicts, Chapter 9 for rebase, Chapter 11 for the stash commands, Chapter 13 for unreachable objects, Chapter 14D for
safe.bareRepository.
Chapter 25: Worktrees
From section 25.14 of Chapter 25: Worktrees.
Primary sources
- git-worktree (external site): commands, the REFS, CONFIGURATION FILE, DETAILS and BUGS sections. The local copy (
git help -m worktree) is the Git 2.55.0 text that the transcripts were checked against. Source of the current manual: git-worktree.adoc (external site). gc.worktreePruneExpire,extensions.worktreeConfig,worktree.guessRemote,worktree.useRelativePaths,checkout.defaultRemote:git help -m config.- git-rebase (external site) for
--update-refsand branches checked out in a worktree; git-refs (external site) for the migration limitation. - Release notes: 2.48.0 (external site), 2.56.0 (external site).
Secondary sources
- The Phase 0 report of this course, section 1 (the table of newer commands and the maintenance defaults) and section 13.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Scott Chacon, "So You Think You Know Git Part 2 - DevWorld 2024" (external site) (23 min, 2024): worktrees among other topics. Current.
- Edward Thomson, "You Don't Know Git" (external site), NDC London 2025 (1 h 02 min): reflog, rerere, worktrees, rebase variants. Current.
- glich.stream, "Chad level git: advanced concepts (2025)" (external site) (1 h 14 min): hands-on, includes worktrees and Git LFS. Current.
Further reading
- gitrepository-layout (external site) for the
worktrees/directory and thecommondirandgitdirfiles.
Module 15: submodules, subtrees, LFS
Chapter 22: Git LFS
From section 22.18 of Chapter 22: Git LFS.
Primary sources
- Git LFS: the specification (external site), server discovery (external site) and custom transfers (external site) in the project's repository, read on 2 October 2026; the help texts of the installed client 3.7.1 (
git lfs <command> --help), which the transcripts were checked against; releases (external site). - GitHub Docs, read on 2 October 2026: About large files on GitHub (external site), About Git Large File Storage (external site), Git LFS billing (external site), Collaboration with Git LFS (external site), Removing files from Git LFS (external site), Repository limits (external site).
- gitattributes (external site) for filter drivers;
actions/checkoutaction.yml (external site) at v7.0.1.
Secondary sources
- The Phase 0 report of this course: section 2 (the large-files paragraph), section 13 ("Scale, submodules and large files") and section 15 ("Data and model versioning"), with the research notes on AI/ML workflows.
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- glich.stream, "Chad level git: advanced concepts (2025)" (external site) (1 h 14 min): hands-on, includes Git LFS. Current.
- Vikash Das, "MLOps: Day 4 - Data Versioning using DVC" (external site) (1 h 25 min, 2024, Hindi): why Git alone does not suit data, and DVC beside Git. Mostly current; DVC CLI versions not checked.
Further reading
- Chapter 28 for data and model versioning beyond LFS; Chapter 26 for partial clone, which is Git's own way of not downloading every blob.
Chapter 23: Submodules and Subtrees
From section 23.21 of Chapter 23: Submodules and Subtrees.
Primary sources
- git-submodule (external site), gitsubmodules (external site), gitmodules (external site), git-push (external site) (
--recurse-submodules). The local copies (git help -m submodule,git help -m gitsubmodules,git help -m config) are the Git 2.55.0 text that the transcripts were checked against. - git-subtree (external site) in Git's
contrib/directory, read on 2 October 2026; locally,git subtree -h. - Protocol configuration (external site); release notes 2.38.1 (external site) and 2.30.6 (external site).
- Security advisories GHSA-8h77-4q3w-gfgv (external site) (CVE-2024-32002) and GHSA-vwqx-4fm8-6qc9 (external site) (CVE-2025-48384).
actions/checkoutaction.yml (external site) and README (external site) at v7.0.1, the README read on 2 October 2026.
Secondary sources
- Pro Git, Git Tools: Submodules (external site), which documents the failure modes of sections 23.5 to 23.10 from the user's side.
- The Phase 0 report of this course, section 12 (the misconception table), section 13 ("Scale, submodules and large files") and section 14 ("The Git client").
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Tobias Günther for freeCodeCamp, "Advanced Git Tutorial" (external site) (34 min, 2021): includes a submodules segment. Concepts current; mixes
masterandmainand usescheckout.
Further reading
- gitrepository-layout (external site) for
modules/; Chapter 24 for the alternative of one repository.
Modules 16 and 17: the object database, the index, refs and the Git directory
Chapter 3: Git Internals
From section 3.21 of Chapter 3: Git Internals.
Primary sources
The local manual pages for the Git you run: git help gitformat-loose, gitformat-pack, gitformat-index, gitformat-signature, gitrepository-layout, gitdatamodel, gitglossary, gitrevisions, and the pages of every command used above. Online, at the 2.56.0 tag: gitdatamodel (external site), gitformat-loose (external site), gitformat-pack (external site), gitformat-index (external site), gitformat-signature (external site), gitrepository-layout (external site), glossary (external site), revisions (external site), git-refs at 2.55 (external site), the reftable design (external site), repository format versions (external site), hash-function-transition (external site), BreakingChanges (external site), the release notes for 2.13 (external site), 2.29 (external site), 2.42 (external site), 2.45 (external site), 2.46 (external site), 2.51 (external site) and 2.53 (external site), and the commit "fsck: snapshot default refs before object walk" (external site).
Secondary sources
Pro Git, chapter 10: objects (external site), packfiles (external site) and maintenance and recovery (external site); frozen since May 2024, so it predates reftable and the glossary change. The GitHub Blog, Git's database internals, part I (external site). The Phase 0 report of this course for the hosting facts of section 3.14.
Videos
Derrick Stolee, "Git Internals: a Database Perspective" (external site) (Git Merge 2022, 27 min): packfiles and the storage layer; current. John Britton, "Git Internals" (external site) (CS50, 2018, 58 min): the object model, correct and clear; master, checkout, SHA-1 only, almost nothing on packfiles. Patrick Steinhardt, "Reftable Backend" (external site) (2025, 20 min) and Emily Shaffer, "SHA-256 at a Hyperscaler" (external site) (Git Merge 2026, 32 min): both assume this chapter's level; the second had almost no views when the report checked it.
Further reading
James Coglan, Building Git, teaches the formats by reimplementing them; "Write yourself a Git" (external site) does the same in Python. Both predate reftable.
Modules 16 and 18: maintenance, transfer and scale
Chapter 26: Performance
From section 26.22 of Chapter 26: Performance.
Primary sources
The local manual of Git 2.55.0: git help maintenance, gc, repack, commit-graph, multi-pack-index, fsmonitor--daemon, update-index, clone, fetch, rev-list, backfill, bundle, config. Online: git-maintenance (external site), git-gc (external site), git-repack (external site), git-commit-graph (external site), gitformat-commit-graph (external site), git-multi-pack-index (external site), bitmap-format (external site), gitformat-pack (external site), git-fsmonitor--daemon (external site), shallow (external site), partial-clone (external site), git-backfill (external site), git-bundle (external site), bundle-uri (external site), gitprotocol-v2 (external site), api-trace2 (external site). Git source at the 2.55.0 tag: builtin/gc.c (external site) (strategies, tasks and thresholds) and odb/source-loose.c (external site) (the loose-object estimate).
Secondary sources
Derrick Stolee, Git's database internals, GitHub Blog, 2022: I, the packed object store (external site), II, commit history queries (external site), III, file history queries (external site), IV, distributed synchronization (external site). Get up to speed with partial clone and shallow clone (external site) (2020). Taylor Blau, Scaling monorepo maintenance (external site) (2021). Jeff Hostetler, the file system monitor (external site) (2022). The practitioner reports of section 26.15: each from the publisher's own environment and date, not comparable with one another. The Phase 0 report of this course, sections 1, 12 and 13.
Videos
(optional; assessments from the Phase 0 report). Derrick Stolee, "Git Internals: a Database Perspective" (external site) (Git Merge 2022, 27 min): pack indexes, the multi-pack-index, bitmaps, git maintenance start; current, and the best compact talk on this layer. Derrick Stolee, "Git at Scale for Everyone" (external site) (32 min, 2020): partial clone and background maintenance; the Scalar packaging shown is the one of 2020.
Further reading
Chapter 3, section 3.7, for packs and deltas; Chapter 13, sections 13.4 and 13.13, for retention; Chapter 24 for the working-tree side; Chapter 29 for traces in diagnosis.
Chapter 24: Monorepos
From section 24.18 of Chapter 24: Monorepos.
Primary sources
The local manual of Git 2.55.0: git help sparse-checkout with its "Internals" sections, git help scalar, git help clone, git help backfill. Online: git-sparse-checkout (external site), scalar (external site), git-backfill (external site), partial-clone (external site), git-describe (external site), the sparse-index design notes (external site) and scalar.c (external site) at the 2.55.0 tag. Potvin and Levenberg, Why Google Stores Billions of Lines of Code in a Single Repository (external site) (2016; not Git). Engineering at Meta, Sapling (external site) (2022). GitHub Docs as linked in sections 24.8 and 24.9.
Secondary sources
GitHub Blog: sparse-checkout (external site) (2020), sparse index (external site) (2021), The Story of Scalar (external site) (2022), Git's database internals V (external site) (2022) on ways to split a repository. Software Engineering at Google, chapter 16 (external site). The practitioner reports linked in section 24.2, each from the publisher's own environment. The Phase 0 report of this course, sections 1, 12 and 13.
Videos
(optional; assessments from the Phase 0 report). Derrick Stolee, "Git at Scale for Everyone" (external site) (32 min, 2020): partial clone and a cone-mode demo; concepts current, the Scalar packaging is the one of 2020. Scott Chacon, "So You Think You Know Git" (external site) (FOSDEM 2024, 47 min): a survey, with about a minute of product pitch. Stolee's Scalar talk (external site) (2021) and "Scaling Git at Microsoft" (external site) (2017) describe superseded designs: history only.
Further reading
Chapter 26 for maintenance, the commit-graph and clone shapes; Chapter 25 for per-worktree configuration.
Modules 19 and 25: the GitHub platform, the CLI and the API
Chapter 15: GitHub
From section 15.26 of Chapter 15: GitHub.
Primary sources
- GitHub Docs, read on 2 October 2026: types of accounts (external site), repository roles (external site), base permissions (external site), repository visibility (external site), forks (external site), linking a pull request to an issue (external site), about releases (external site), immutable releases (external site), issue forms (external site), community health files (external site), repository limits (external site), large files (external site), Packages (external site), API versions (external site), rate limits (external site), webhooks (external site).
- The GitHub CLI:
gh <command> --helpof the installed 2.88.1 for every command and flag in this chapter; the manual (external site) and release notes (external site) for newer versions. - The GitHub Changelog entries linked in the sections.
- Git: gitnamespaces (external site) for the model in section 15.7; git-describe (external site), git-rev-list (external site), git-cat-file (external site), as installed with Git 2.55.0.
Secondary sources
- The Phase 0 report of this course, sections 2, 3, 4 and 12, and its research notes on the GitHub platform: the dated changes, the plan gates and the flags marked unverified here.
- Check Point Research, Stargazers Ghost Network (external site), cited by the report.
Videos
(optional; the report's assessments rest on captions and chapter lists, not on full viewing)
- The ultimate beginner's guide to GitHub in 2026 (external site), GitHub, 51 minutes, 22 September 2025. Caveats: mechanics only; compiled from 2024 episodes.
- Git and GitHub - Full Course (external site), ThePrimeagen for Boot.dev, 12 November 2024: remotes and GitHub from 1:54:18, then forks.
- The report found no verified video on roles, fork networks, releases or the API at this depth.
Further reading
- GitHub flow (external site) and best practices for organizations (external site).
- Chapter 18 for governance, Chapter 21B for fork networks during a secret leak, Chapter 27 for open-source practice.
Module 20: authentication and SSH
Chapter 16: Authentication
From section 16.27 of Chapter 16: Authentication.
Primary sources
- GitHub Docs, read on 2 October 2026: about authentication (external site), managing personal access tokens (external site), credential types (external site), token expiration and revocation (external site), caching credentials (external site), generating an SSH key (external site), testing your SSH connection (external site), GitHub's SSH key fingerprints (external site), SSH over the HTTPS port (external site), Permission denied (publickey) (external site), Host key verification failed (external site), troubleshooting cloning errors (external site), managing multiple accounts (external site), deploy keys (external site), single sign-on (external site), mandatory two-factor authentication (external site).
- GitHub Blog and Changelog: token authentication requirements (external site), improving Git protocol security (external site), the RSA host key (external site), security improvements for SSH (external site).
- Git 2.55.0: gitcredentials (external site), git-credential (external site), git-config (external site) (
credential.*,transfer.credentialsInUrl,url.<base>.insteadOf,includeIf), as installed (git help -m <page>); the source files http.c (external site) and remote-curl.c (external site) for what Git does on 401, 403 and 404. - OpenSSH as installed (
man ssh,man ssh_config,man ssh-keygen,man ssh-add); online at man.openbsd.org (external site). - The GitHub CLI:
gh auth <command> --helpof 2.88.1, and helper_config.go (external site) for whatgh auth setup-gitwrites.
Secondary sources
- The Phase 0 report of this course, section 2 (authentication, the error table, the flags) and section 4, and its research notes on the GitHub platform, section 4.
- Pro Git, Credential Storage (external site): the helper protocol with a custom helper. Caveat: predates the GitHub CLI and fine-grained tokens.
Videos
(optional; the report's assessments rest on captions and chapter lists, not on full viewing)
- Git & GitHub Crash Course 2025 (external site), Traversy Media, 49 minutes, 13 January 2025: SSH key setup. Caveat: beginner scope.
- Complete git and Github course in Hindi (external site), Chai aur Code, 8 June 2024: states that passwords no longer work and sets up SSH. Caveat: audited through auto-generated captions.
- No verified video covers credential helpers, token types or authentication diagnosis at this depth.
Further reading
- Authenticating to the REST API (external site) and troubleshooting the REST API (external site), for the 401, 403 and 404 rules that Git's HTTPS errors inherit.
- Chapter 21A for the workflow token and OIDC, Chapter 21B for credential blast radius, token forensics and the response to a leaked secret, Chapter 29 for the troubleshooting playbook.
Modules 21 and 22: pull requests, forks, merge methods, releases
Chapter 17: Pull Requests
From section 17.25 of Chapter 17: Pull Requests.
Primary sources
(docs.github.com, the GitHub Changelog and cli.github.com; read on 1 and 2 October 2026)
- Reference pages: Pull requests (external site), Branches (external site), Pull request merges (external site), Pull request reviews (external site), Status checks (external site), Merge conflicts (external site), Forks (external site), Stacked pull requests (external site)
- How-to pages: Checking out pull requests locally (external site), Merging a pull request (external site), Troubleshooting required status checks (external site), Syncing a fork (external site); the others are linked where they are quoted.
- Repository pages: About merge methods on GitHub (external site), Managing a merge queue (external site), Repository limits (external site), About commit signature verification (external site), REST API endpoints for pull requests (external site), Events that trigger workflows (external site)
- Changelog entries, linked where they are used: 19 February 2026 (test merge commits), 30 July 2026 (stacked pull requests), 1 October 2026 (asynchronous merge API).
- GitHub CLI:
gh pr --helpand its subcommands (2.88.1, local); gh pr manual (external site). - Git 2.55 manual pages:
git help merge-tree,git help rebase,git help branch,git help cherry,git help config(receive.hideRefs); the gitfaq (external site) entry on squash merges and long-lived branches.
Secondary sources
- The Phase 0 report of this course, sections 2, 3, 12 and 13, and its notes on the GitHub platform.
- GitHub Engineering, Scaling merge-ort across GitHub (external site) (2023): why a server needs a merge without a working tree.
Videos
(from the Phase 0 report, with its caveats)
- "The ultimate beginner's guide to GitHub in 2026" (external site), GitHub, 22 September 2025: the pull request and merge chapters, 40:44 to 47:14. Mechanics only; compiled from 2024 episodes. The report found no verified video that teaches code review end to end in the 2026 interface.
Further reading
- Chapter 8: Merge, sections 8.12, 8.15 and 8.17; Chapter 9: Rebase, sections 9.9 and 9.14; Chapter 12: Remote Operations, sections 12.8, 12.10 and 12.12; Chapter 14A: History investigation, sections 14A.2, 14A.8, 14A.18 and 14A.22.
- Pro Git, "Contributing to a Project" (external site): the fork-and-pull flow at a book's pace; its screenshots predate the current interface.
Module 23: governance
Chapter 18: Branch Protection and Rulesets
From section 18.25 of Chapter 18: Branch Protection and Rulesets.
Primary sources
(docs.github.com and the GitHub Changelog; read on 1 and 2 October 2026)
- Rulesets: About rulesets (external site) and its Enterprise Cloud view (external site), Available rules for rulesets (external site), Creating rulesets for a repository (external site), Managing rulesets for a repository (external site), Troubleshooting rules (external site), Converting branch protections to rulesets (external site), Creating rulesets for repositories in your organization (external site)
- Classic protection: About protected branches (external site)
- Checks: Troubleshooting required status checks (external site), Status checks (external site), Skipping workflow runs (external site)
- API and CLI: REST API endpoints for rules (external site), rule suites (external site), branch protection (external site);
gh ruleset --helpandgh api --help(2.88.1, local); gh ruleset manual (external site) - Roles: Repository roles for an organization (external site)
- Changelog entries are linked where they are used.
- Ruby's
File.fnmatch(external site), the function GitHub's documentation links to; Git 2.55:git help hooks(pre-receive),git help config(receive.denyNonFastForwards).
Secondary sources
- The Phase 0 report of this course, sections 2, 3, 4 and 13, and its notes on the GitHub platform.
github/ruleset-recipes(external site): GitHub's importable example rulesets.
Videos
(from the Phase 0 report, with its caveats)
- "Introduction to GitHub Actions - Part 6 - Repository Rulesets" (external site), Mickey Gousset, 6 December 2024, 15 minutes: a ruleset that requires a status check, the bypass list, rulesets versus classic rules. Current; slow and careful.
- "Securely building GitHub on GitHub" (external site), GitHub Universe 2024, 41 minutes: rulesets, Rule Insights, Evaluate mode and bypass lists at scale. Predates the 2025 and 2026 ruleset additions.
Further reading
- Chapter 12: Remote Operations, section 12.7 (server-side rules in plain Git); Chapter 14B, sections 14B.11 and 14B.15 to 14B.17; Chapter 17: Pull Requests, sections 17.5, 17.8 and 17.11.
Chapter 19: CODEOWNERS
From section 19.18 of Chapter 19: CODEOWNERS.
Primary sources
(docs.github.com and the GitHub Changelog; read on 1 and 2 October 2026)
- About code owners (external site): locations, syntax, the example file, size limit, write-access requirement, forks, branch protection.
- Available rules for rulesets (external site): code owner review and the required reviewers sub-option.
- REST API: list CODEOWNERS errors (external site).
- Changelog, 17 February 2026: required reviewer rule generally available (external site).
- Stacked pull requests (reference) (external site).
- Git 2.55: gitignore pattern format (external site) (
git help ignore),git help check-ignore.
Secondary sources
- The Phase 0 report of this course, section 2 ("CODEOWNERS requests reviews; only a rule makes them mandatory"), and its notes on the GitHub platform, section 3.
Videos
- The Phase 0 report lists no verified video that teaches CODEOWNERS; its survey of popular beginner courses found that none covers it.
Further reading
- Chapter 17: Pull Requests, sections 17.3 to 17.5; Chapter 18: Branch Protection and Rulesets, sections 18.5 and 18.7; Chapter 4: The Working Tree, for
.gitignoreitself.
Module 26: Actions fundamentals
Chapter 20A: GitHub Actions Fundamentals
From section 20A.22 of Chapter 20A: GitHub Actions Fundamentals.
Primary sources
(docs.github.com, the GitHub Changelog, and each action's repository at the pinned tag; read on 1 and 2 October 2026)
- Reference pages: workflow syntax (external site), events that trigger workflows (external site), contexts (external site), expressions (external site), variables (external site), secrets (external site), workflow commands (external site), dependency caching (external site), limits (external site), GitHub-hosted runners (external site), reusing workflow configurations (external site).
- Other documentation: workflow artifacts (external site), GITHUB_TOKEN (external site), skipping workflow runs (external site), troubleshooting required status checks (external site), publishing a package with Actions (external site).
- Action READMEs and
action.ymlfiles at the pinned versions: checkout v7.0.1 (external site), setup-python v7.0.0 (external site), setup-java v6.0.1 (external site), cache v6.1.0 (external site), upload-artifact v7.0.1 (external site), download-artifact v8.0.1 (external site), setup-uv v10.2.0 (external site), docker/login-action v4.6.0 (external site), docker/metadata-action v6.2.0 (external site), docker/build-push-action v7.4.0 (external site), docker/setup-buildx-action v4.4.1 (external site). - Tool documentation: uv with GitHub Actions (external site), Docker: cache management with GitHub Actions (external site).
- Changelog entries, linked where they are used.
- Git 2.55 manual pages:
git help clone,git help fetch,git help describe,git help diff. GitHub CLI 2.88.1:gh run --help,gh workflow --help,gh cache --help.
Secondary sources
- The Phase 0 report of this course, sections 2, 3, 4, 12 and 13, and its notes on GitHub Actions, including the flags carried into this chapter as "Unverified".
Videos
(from the Phase 0 report, with its caveats)
- "Complete GitHub Actions Course - From BEGINNER to PRO" (external site), Sid Palas, DevOps Directive, 3 h 43 min, 24 September 2025. The most complete current free course on workflow mechanics. It predates the Node 24-only runtime and
actions/checkoutv7, says "branch protections" and never mentions rulesets. - "GitHub Actions tutorial in Hindi" (external site), CODERS NEVER QUIT, 1 h 51 min, 27 September 2024, Hindi. Jobs, expressions, checkout, caching and artifacts. Mostly current in concept; the action versions shown were not checked; no pinning.
Further reading
- Chapter 17: Pull Requests, sections 17.2, 17.6 and 17.11; Chapter 18: Branch Protection and Rulesets on required status checks; Chapter 19: CODEOWNERS on protecting the workflows directory; Chapter 26: Performance, section 26.11 on shallow clones; Chapter 14A: History investigation on two-dot and three-dot ranges.
Modules 27 and 28: build, package, deliver; runners and debugging CI
Chapter 20B: GitHub Actions: delivery, runners, cost and debugging
From section 20B.22 of Chapter 20B: GitHub Actions: delivery, runners, cost and debugging.
Primary sources
- GitHub Docs: deployments and environments (external site), managing environments (external site), control deployments (external site), reviewing deployments (external site), REST: deployment environments (external site).
- GitHub Docs: workflow syntax (external site), reusing workflow configurations (external site), reuse workflows (external site), metadata syntax (external site), custom actions (external site).
- GitHub Docs: GitHub-hosted runners (external site), self-hosted runners (external site), secure use (external site), limits (external site), billing (external site), runner pricing (external site).
- GitHub Docs: dependency caching (external site), using secrets (external site), enable debug logging (external site), re-running workflows and jobs (external site), troubleshooting workflows (external site), skipping workflow runs (external site), troubleshooting required status checks (external site).
- Action documentation at the pinned versions: actions/checkout v7.0.1 (external site), actions/cache v6.1.0 (external site), actions/upload-artifact v7.0.1 (external site), actions/download-artifact v8.0.1 (external site), astral-sh/setup-uv v10.2.0 (external site).
- GitHub CLI manual: gh run view (external site), gh run rerun (external site), gh run watch (external site), gh workflow run (external site), and the
--helpoutput of the installed 2.88.1. - The local Git manual:
git help describe,git help ls-files,git help gitattributes,git help config(core.ignoreCase).
Secondary sources
- actionlint (external site) and act: unsupported functionality (external site), third-party tools, not installed for this course.
- The GitHub changelog entries linked in the text for each dated change.
Videos
(from the Phase 0 report, with its caveats)
- "Complete GitHub Actions Course - From BEGINNER to PRO" (external site), Sid Palas, DevOps Directive, 3 h 43 min, 24 September 2025. The most complete current free course; it has sponsor segments, says "branch protections" and never mentions rulesets, and pre-dates Node 24-only runners and
actions/checkoutv7. - "Introduction to GitHub Actions - Part 6 - Repository Rulesets" (external site), Mickey Gousset, 15 min, 6 December 2024. A ruleset that requires a status check.
Further reading
- Chapter 18, section 18.8, for required status checks from the ruleset side; Chapter 21A for the security model of everything in this chapter.
Module 29: Actions security
Chapter 21A: GitHub Actions security
From section 21A.26 of Chapter 21A: GitHub Actions security.
Primary sources
- GitHub Docs: secure use reference (external site); securely using pull_request_target (external site); script injections (external site); GITHUB_TOKEN (external site); workflow syntax (external site); OIDC reference (external site); OIDC in AWS (external site); dependency caching (external site); secrets reference (external site); managing GitHub Actions settings for a repository (external site); about Actions policies (external site); keeping your actions up to date with Dependabot (external site).
- GitHub changelog entries, linked where each change is described (sections 21A.3, 21A.5, 21A.7, 21A.8, 21A.10, 21A.11, 21A.15).
- actions/checkout README at v7.0.1 (external site).
- Advisories and post-mortems: CISA on tj-actions (external site); GHSA-mrrh-fwg8-r2c3 (external site); Nx post-mortem (external site); GHSA-69fq-xp46-6x23 (external site); Aqua incident notice (external site); TanStack post-mortem (external site); PyPI on Ultralytics (external site); Codecov security update (external site).
Secondary sources
- GitHub Security Lab: preventing pwn requests (external site) (2021; parts 2 to 4 of the series were not consulted).
- Vendor and researcher analyses: Unit 42 (external site); GitGuardian on GhostAction (external site); Wiz on Shai-Hulud 2.0 (external site); Datadog Security Labs (external site); StepSecurity on hackerbot-claw (external site); John Stawinski on PyTorch (external site).
- Secondary reporting only: Techzine (external site); The Hacker News (external site).
- Tools: zizmor audits (external site); actionlint (external site); OpenSSF Scorecard checks (external site).
Videos
(from the Phase 0 report, with its caveats)
- Adnan Khan, "The dark side of GitHub Actions" (external site), RomHack 2024, 53 min. The vulnerability classes are current; GitHub defaults have changed since.
- Niek Palm, "Beyond the Commit: Weaponizing and Hardening GitHub Actions" (external site), NDC Security 2026, 55 min. The most current defender-oriented talk; it pre-dates the June to September 2026 platform changes.
- "Tag, You're Leaked: Surviving the tj-actions Supply Chain Attack" (external site), BSides PDX 2025, 24 min. An incident-response case study.
Further reading
- GitHub's 2026 security roadmap for Actions (external site): announced work, not shipped features.
workflows/ACTION_PINS.mdin this course: the pins and how to re-verify them.
Modules 24 (GitHub part), 30 and 31: repository security and secret-leak response
Chapter 21B: Repository security, identity, the Git client, and secret-leak response
From section 21B.27 of Chapter 21B: Repository security, identity, the Git client, and secret-leak response.
Primary sources
- Git 2.55 manual pages:
git help git(SECURITY),git help config(safe.*,protocol.*),git help filter-branch(WARNING),git help hook,git help githooks. - Git security advisories (external site); safe configuration (external site); protocol configuration (external site); githooks (external site).
- GitHub Docs, fetched 2 October 2026: removing sensitive data from a repository (external site); remediating a leaked secret (external site); about push protection (external site); Dependabot options reference (external site). Through the Phase 0 report: about secret scanning (external site); supported patterns (external site); commit signature verification (external site); credential types (external site); security features (external site).
- git-filter-repo manual (external site) (fetched 2 October 2026).
Secondary sources
- GitGuardian, State of Secrets Sprawl 2026 (external site); GitGuardian on leaked GitHub App private keys (external site).
- Russ Cox, timeline of the xz open source attack (external site).
- The research, incident reports and articles linked where they are used, in sections 21B.4, 21B.8, 21B.10, 21B.14 and 21B.15.
Videos
(from the Phase 0 report, with its caveats)
- "git-filter-repo for rewriting Git history" (external site), Elijah Newren, Git Merge 2024, 22 min. A contributor talk on what the tool does and how it compares with filter-branch and BFG; not a step-by-step incident tutorial.
- Git Merge 2022 workshop on SSH commit signing (external site), listed by the roadmap for Module 24.
- "Day-2: DevSecOps for Git and GitHub" (external site), Abhishek Veeramalla, 46 min, 22 January 2026. Shows a branch ruleset, CODEOWNERS, gitleaks through pre-commit and in Actions, and Dependabot together; no signing, OIDC or action pinning.
Further reading
- Chapter 13: Recovery for reflogs, pruning and the GitHub-side recovery instruments; Chapter 14B for local signing; Chapter 16 for credential mechanics; Chapter 12 for force pushes.
Modules 32 and 34: branching and release strategy, practices and design review
Chapter 27: Open source and team workflows
From section 27.25 of Chapter 27: Open source and team workflows.
Primary sources
- Git 2.55 manual pages:
git help workflows(gitworkflows (external site)),git help cherry-pick,git help rev-list(--cherry-pick,--left-right),git help branch,git help merge-tree,git help for-each-ref. - GitHub Docs: GitHub flow (external site), Forks (external site), Syncing a fork (external site), About merge methods (external site), Managing a merge queue (external site), Setting guidelines for repository contributors (external site), About releases (external site).
- GitHub CLI 2.88.1, local help:
gh repo fork --help,gh repo sync --help,gh pr create --help. - The authors of the models: Vincent Driessen, A successful Git branching model (external site) with the 2020 note; Scott Chacon, GitHub Flow (external site); GitLab, What is GitLab Flow? (external site); trunkbaseddevelopment.com (external site); Microsoft, How Microsoft develops with DevOps (external site).
- DORA capability pages: trunk-based development (external site), working in small batches (external site), version control (external site).
- Conventions: How to Write a Git Commit Message (external site), Conventional Commits 1.0.0 (external site), Semantic Versioning 2.0.0 (external site), Keep a Changelog 1.1.0 (external site).
Secondary sources
- The Phase 0 report of this course, sections 6, 12 and 13, and section 6 of its notes on books, documentation and misconceptions.
- Martin Fowler, Patterns for Managing Source Code Branches (external site); Pete Hodgson, Feature Toggles (external site); Rouan Wilsenach, Ship / Show / Ask (external site).
- Lopes, Accioly, Borba and Menezes, interview-and-survey study of branching workflows, arXiv 2507.08943 (external site).
- Vendor and company material, linked where used, each describing its own environment: GitHub and Shopify on merge queues, Atlassian on Gitflow.
Videos
(from the report's tables, with its caveats)
- 3 Git Workflows Every Developer Should Know (external site), TechWorld with Nana, 13 January 2026, 32 minutes: a neutral comparison of Git Flow, GitHub Flow and trunk-based development. Caveat: it has a sponsored segment.
- Continuous Integration vs Feature Branch Workflow (external site), Dave Farley, 6 January 2021, 18 minutes: the argued case for trunk. Caveat: deliberately one-sided advocacy; watch it after the first, and with section 27.13 beside you.
- Implementing a Strong Code-Review Culture (external site), Derek Prior, RailsConf 2015, 38 minutes: review as teaching and context-giving. Tool-independent and still valid.
Further reading
- Jackson Gabbard, Stacked Diffs Versus Pull Requests (external site), and Gergely Orosz, Stacked Diffs (external site).
- Accelerate (Forsgren, Humble, Kim, 2018), the book-length statement of the DORA research.
- Chapter 28: AI/ML workflows applies this chapter to repositories that also hold notebooks, data pointers and evaluation runs.
Module 33: AI/ML workflows
Chapter 28: AI/ML workflows
From section 28.22 of Chapter 28: AI/ML workflows.
Primary sources
- Git 2.55 manual pages:
git help attributes(filters,text,merge),git help ignore,git help check-ignore,git help describe,git help status(porcelain format),git help worktree,git help apply. - Notebooks: nbformat (external site), nbstripout (external site), nbdime (external site) and its Git integration (external site), jupytext (external site), ReviewNB (external site), GitHub's rich notebook diff preview (external site).
- Data and models: About large files on GitHub (external site), About Git LFS (external site), DVC: get started (external site), DVC joins lakeFS (external site), lakeFS licence change (external site), Hugging Face download guide (external site), MLflow model registry (external site).
- Reproducibility: MLflow system tags (external site), W&B code saving (external site), Hydra output directory (external site), uv project layout (external site) and locking (external site), Docker build best practices (external site), git-describe (external site).
- Hooks and CI: pre-commit (external site), pre-commit-hooks (external site), ruff-pre-commit (external site), uv with GitHub Actions (external site), larger runners (external site), push protection (external site), promptfoo GitHub Action (external site), DeepEval in CI (external site).
- Structure, Docker and Java: Cookiecutter Data Science (external site), PyPA on src and flat layouts (external site), Docker build secrets (external site), GitHub's Python ignore template (external site), Gradle Wrapper (external site), Dependabot ecosystems (external site).
Secondary sources
- The Phase 0 report of this course, sections 14 and 15, and its notes on AI/ML workflows and security. Every version, date, licence and status in this chapter comes from there; its flags are carried as "Unverified" callouts.
- GitGuardian, How to handle secrets in Jupyter notebooks (external site) and State of Secrets Sprawl 2026 (external site): one vendor's measurements.
- DORA, 2025 report (external site) and version control capability (external site).
- StepSecurity and Techzine on agents in workflows, linked in section 28.15.
Videos
(from the report's tables, with its caveats)
- MLOps: Day 4 - Data Versioning using DVC (external site), Vikash Das, in Hindi, 7 August 2024, 1 h 25 min: why Git alone does not suit data, DVC beside Git, an S3 remote,
dvc pushanddvc pull. Caveats: DVC CLI versions were not checked; no pipelines or CI. - How to build a ML project using MLOps (external site), CampusX, in Hindi, 25 November 2024, 1 h 21 min. Use it as a concept map only: the report notes no workflow YAML, no
dvc pushordvc pull, and no remote storage.
Further reading
- Chapter 14C for filters, drivers and hooks in full; Chapter 22 for Git LFS; Chapter 25: Worktrees for the worktree used in Lab 33.3.
- Chapter 27: Open source and team workflows for branching, release tags and the fork model that section 28.11 collides with.
Module 35: the diagnosis method
Chapter 29: Production Troubleshooting
From section 29.18 of Chapter 29: Production Troubleshooting.
Primary sources
- The manual pages of Git 2.55.0, read locally with
git help -m <command>: git-status, git-rebase, git-merge, git-cherry-pick, git-revert, git-bisect, git-bundle, git-update-ref, git-for-each-ref, git-ls-remote, git-merge-tree, git-check-ignore, git-fsck, git-config, gitrevisions, gitrepository-layout. git-prompt.shas installed by Homebrew's Git at/opt/homebrew/etc/bash_completion.d/git-prompt.sh: the header comments document__git_ps1.- GitHub Docs: Using the activity view to see changes to a repository (external site); REST: list repository activities (external site); Issue event types (external site); GitHub event types: PushEvent (external site); REST API endpoints for events (external site); Viewing insights for rulesets (external site); Reviewing the audit log for your organization (external site); Audit log for an enterprise (external site); Deleting and restoring branches in a pull request (external site); Troubleshooting commits (external site); Troubleshooting required status checks (external site).
- GitHub Changelog: Upcoming changes to GitHub Events API payloads (external site).
Secondary sources
- Phase 0 report, sections 12 and 13, and the research notes
github_platform.md, from which every GitHub-side fact and flag in section 29.8 is taken. - Yang et al., the ACM TOSEM study of Git-command questions (author preprint (external site)). The report flags the final volume and article number as not confirmed.
Videos
(optional; the assessments in the Phase 0 report rest on captions, not on full viewing)
- How to Undo Mistakes With Git Using the Command Line (external site), Tobias Günther for freeCodeCamp, 55 minutes, 24 November 2020: restore, amend, revert, reset, recovery with the reflog. Caveat:
masternaming. - Lecture 5: Version Control and Git (external site), MIT Missing Semester 2026, 1 hour 10 minutes: the data model before the commands, and the reflog as a safety net.
Further reading
- Chapter 13: Recovery, for every case in which something was lost.
- Chapter 12: Remote Operations, section 12.14, and Chapter 16: Authentication, sections 16.17 to 16.20, for the two other diagnosis procedures of this book.
- Chapter 18: Branch Protection and Rulesets, section 18.17, "Why can't I merge?".
- The troubleshooting playbook.
Modules 36 to 38: incident drills, communication and postmortems
Chapter 30: Incident Response
From section 30.27 of Chapter 30: Incident Response.
Primary sources
- Local manual pages of Git 2.55.0:
git help reflog,git help push(the lease forms),git help rebase(--onto,--empty),git help cherry,git help range-diff,git help fsck,git help log(history simplification,--remerge-diff),git help describe. - GitHub Docs: Activity view (external site); deleting and restoring branches in a pull request (external site); Events API (external site); create a reference (external site); troubleshooting commits (external site); available rules for rulesets (external site); removing sensitive data from a repository (external site); remediating a leaked secret (external site); push protection (external site).
- actions/checkout README, v7.0.1 (external site).
- The Phase 0 report, sections 12 to 14, including its unverified flags for the GitHub-side recovery recipe.
Secondary sources
- git-filter-repo manual (external site), for the clean-up of other clones after a rewrite.
- Google, Site Reliability Engineering, Postmortem Culture: Learning from Failure (external site).
- Julia Evans, what can go wrong with rebasing (external site).
- Truffle Security, commits orphaned by force pushes (external site): an observation by researchers, not a statement by GitHub.
Videos
- "Tag, You're Leaked: Surviving the tj-actions Supply Chain Attack" (external site), BSides PDX 2025, 24 minutes. A 72-hour incident response for GitHub Actions; the Phase 0 report calls it the closest thing to a production incident-response case study, and notes that it found no conference talk covering end-to-end Git incident recovery with current tooling.
Further reading
- Chapter 13: Recovery, Chapter 29: Production Troubleshooting, Chapter 21B: Repository Security and Secret-Leak Response, Chapter 20B: Delivery, Runners, Cost and Debugging.
Module 42: the frontier
Chapter 14D: The Frontier
From section 14D.18 of Chapter 14D: The Frontier.
Primary sources
- BreakingChanges (external site), read in the copy installed with Git 2.55.0, and the release notes directory (external site).
- git-init (external site), git-config (external site) (
init.*,safe.bareRepository), git-refs (external site), hash-function-transition (external site), git-fast-export (external site), git-fast-import (external site). - git-history (external site), git-replay (external site), git-last-modified (external site), git-repo (external site); for 2.56-only parts, git-history at 2.56 (external site) and git-replay at 2.56 (external site).
- git-format-patch (external site), git-am (external site), git-apply (external site), git-range-diff (external site), git-patch-id (external site), git-send-email (external site), SubmittingPatches (external site), MyFirstContribution (external site), maintain-git (external site).
- The maintainer's message of 28 September 2026, through a mailing-list mirror (external site), as cited in the Phase 0 report.
- The GitHub Changelog (external site), with the entry on stacked pull requests (external site); the Homebrew formula for Git (external site).
Secondary sources
- LWN on the road to 3.0 (external site) and GitLab on Git 2.56 (external site): the only sources for calendar months. The Phase 0 report records a conflict between LWN's paraphrase and the primary message.
- The Phase 0 report of this course, section 1, with its table of flags.
- Git Rev News (external site); the repositories and documentation of Jujutsu (external site), Sapling (external site) and git-branchless (external site).
Videos
(optional; assessments in the Phase 0 report rest on captions, not on full viewing)
- Reftable Backend: What it is, where it's headed and why should you care (external site), Patrick Steinhardt, 20 minutes, 3 September 2025. Caveat: assumes knowledge of internals.
- SHA-256 at a Hyperscaler (external site), Emily Shaffer, Git Merge 2026, 32 minutes, uploaded 1 October 2026. Caveat from the report: almost no views when checked, so there is no secondary quality signal.
- You Don't Know Git (external site), Edward Thomson, NDC London 2025, 1 hour 2 minutes: rerere, the reflog, worktrees and rebase variants.
Further reading
- Chapter 3 for the formats, Chapter 9 for rebase,
--update-refsandgit range-diff, Chapter 10 for patch IDs, Chapter 14C for hooks and their security.
The video path as a whole
The chapters cite videos one at a time. The complete, ordered path, with length, date, level, what to learn from each and what is outdated in it, is section 7 of the Phase 0 research report. Its finding is that a complete path exists only by combining about a dozen sources, and that no single video covers the full list of topics.
See also
Glossary · Git command reference · GitHub reference · command safety
Written against Git 2.55.0 on macOS; GitHub facts as of 1 October 2026. Git transcripts are output from the book’s lab scripts; GitHub behaviour is described from GitHub’s documentation. Found a mistake? Tell us through the enquiry form.