[Git] Sparse Checkout

Sparse Checkout

 git     sparse-checkout  

A subcommand in git used to reduce the files present in the working tree to a subset of all tracked files. Also, the name of the file in the $GIT_DIR/info directory used to track the sparsity patterns corresponding to the user’s desired subset.

---

Steps

1.Init An Empty Repository

mkdir {project}
cd {project}
git init
git remote add -f origin ssh://git@xxxxx/project.git

Now git updates and fetches the origin without cloning anything.

2.Enable Sparse Checkout

git config --local core.sparseCheckout true 

3.Define Sparsity Patterns

Define the sparsity patterns (file paths) that we're only interested.

echo "some/dir/" >> .git/info/sparse-checkout
echo "another/sub/file" >> .git/info/sparse-checkout

Or by the git sparse-checkout set command, notice this overwrite ".git/info/sparse-checkout":

git sparse-checkout set "some/dir/" "another/sub/file

Or by the git sparse-checkout add command that append the path to ".git/info/sparse-checkout":

git sparse-checkout add "some/dir/"
git sparse-checkout add "another/sub/file"

The sparsity patterns supports excluding a path by putting ! before the path.

.git/info/sparse-checkout

/*
!src/

• /*: includes everything at the root and all subdirectories.
• !src/: excludes the src/ folder and everything inside it.

4.Completing Sparse Checkout

And after that, we can do pull, switch or checkout to certain branch, and only the pathes defined in ".git/info/sparse-checkout" will be presented in the working tree.

git pull
git switch my-branch
git checkout my-branch

Other Commands

git sparse-checkout list

Show the sparsity patterns defined.

git sparse-checkout reapply

We can change the sparsity patterns anytime by git sparse-checkout command and it will take effect right away. But if we edit the ".git/info/sparse-checkout", remember to re-apply the changes. e.g.

sed -i "/.*log/d" .git/info/sparse-checkout
git sparse-checkout reapply

---

Reference

• Git: sparse-checkout

[Git] Gitleaks

Gitleaks

 gitleaks     git    security    sast  

https://github.com/gitleaks/gitleaks

Gitleaks is a SAST(Static Application Security Testing) tool for detecting hardcoded secrets like passwords, API keys, and tokens in Git repositories.

---

Installation

See https://github.com/gitleaks/gitleaks#installing

The quickest way is using Go.

git clone https://github.com/gitleaks/gitleaks.git \
cd gitleaks \
make build

After build, copy the gitleaks.exe to $GOBIN and check the version.

cp gitleaks.exe $GOBIN/
gitleaks version

---

Basic concepts

• Detect mode: scan a repository and report potential secrets.
• Exit code: by default, Gitleaks exits with a non‑zero code if leaks are found. This is useful for CI pipelines.

Commands

See full list at https://github.com/gitleaks/gitleaks#usage

Syntax:

gitleaks <COMMAND> [FLAGS]

Command	Description
completion	Generate the autocompletion script for the specified shell
dir	scan directories or files for secrets
git	scan git repositories for secrets
help	Help about any command
stdin	detect secrets from stdin
version	display gitleaks version

Common flags:

Flag	Description
--source PATH_OR_URL	what to scan (local path or remote Git URL).
--report-path FILE	where to write the JSON report.
--redact	hide secret values in the output.
--no-git	scan files as a regular directory (ignore Git history).

---

Gitleaks Configuration

Default configuration(rules and allowlist) is at gitleaks.toml. You can use your custom configuration by flag --config <CONFIG_PATH>. e.g.

gitleaks detect --source . --config ~/gitleaks.toml --redact

---

Audit a local repository

From the repository root

Change into your repo and run:

gitleaks detect --source . --redact

• Scans the entire Git history of the repo
• Prints findings to stdout
• Redacts secret values in the output

Save a JSON report

gitleaks detect \
  --source . \
  --redact \
  --report-path gitleaks-report.json

You can then open gitleaks-report.json in any JSON viewer or feed it into other tools.

Scan only current files (no Git history)

The flag --no-git makes gitleaks only scans the current working tree.

gitleaks detect \
    --source . \
    --no-git \
    --redact \
    --report-path gitleaks-report.json

---

Audit a remote repository (e.g., GitHub)

We can scan a remote repository in two ways:

1. Manually clone it, then scan locally (recommended for repeat scans)
   • You want to scan the same repo multiple times.
   • You want to commit the gitleaks.toml config into the repo.
2. Let Gitleaks clone it on the fly (recommended for quick checks)

Scan Remote Repo by URL (no manual clone)

You can point --source directly at a Git URL.

Public Repository

gitleaks detect \
  --source https://github.com/OWNER/REPO.git \
  --redact
  --report-path gitleaks-OWNER-REPO-report.json

Gitleaks will:

• Clone the repo into a temporary directory
• Scan its history
• Remove the temporary clone after completion

Private Repository

For private repositories you must provide credentials (for example, a GitHub Personal Access Token via environment variables or your Git credential helper).

e.g. Using a GitHub token in the URL:

gitleaks detect \
  --source https://GITHUB_TOKEN@github.com/OWNER/REPO.git \
  --redact

For long-term usage, consider the safer approaches:

• Use environment variables and avoid hardcoding tokens in scripts.
• Use the CI tools, like GitHub Action.

---

Exit codes and CI integration

Gitleaks returns different exit codes depending on the result of the scan

• 0 = no leaks found
• non-zero = leaks or errors

This behavior makes it easy to integrate into CI pipelines (GitHub Actions, GitLab CI, etc.):

• Pass: No secrets detected → pipeline continues
• Fail: Secrets detected → pipeline fails, forcing remediation

Typical CI command:

gitleaks detect --source . --redact --report-path gitleaks-report.json

[Azure DevOps Server] Set default branch

The first blog on 2020 XDDD

[GIT] Rebase

 GIT    rebase  

▌What is rebase

---

We can use rebase to copy the commits from other branch to another.

And after rebasing, we can merge and remove the source branch in order to get the clean single branch with all the commits.

▌Practice

---

Let’s create a new branch: NewBranch, and push a commit: New branch commit.

While there are a new commit: Master commit, on master.

▋Rebase

Now we will rebase NewBranch to master.

$ git rebase master NewBranch

Or

$ git checkout NewBranch $ git rebase master

▋Resolve conflicts

During the rebase process, we may encounter several conflicts.
Notice that we have to resolve these conflicts for every commit in NewBranch.

Here are the three ways to deal with conflicts while rebasing.

1.  Skip this commit

$ git rebase --skip

2.  After resolving the conflict, continue rebasing

$ git rebase --continue

3.  Abort rebasing process

$ git rebase --abort

▋Merge

After resolving conflicts and continue the rebase process.
The git commit graph should be as following, the commit: “New branch commit” is on local

Let’s merge NewBranch to master for merging the commit history to master.

$ git checkout master $ git merge NewBranch $ git push

And delete the NewBranch for a clean commit history.

$ git push origin --delete NewBranch $ git branch –d NewBranch

Which will result in the clean master.

Take a look at the git log of master.

▌Reference

---

▋連猴子都能懂的Git入門指南

▋Git 分支 - 分支的衍合

[Git] Create and Merge a branch

 GIT   GitHub  

▌Create a branch

---

$ git checkout -b [new branch name] $ git push --set-upstream origin [new branch name]

▌Merge a branch

---

Branch : myBranch

Target : master

If I wanna merge [myBranch] to [master], then the command will be like this,

$ git checkout master $ git pull origin master $ git merge myBranch $ git push origin master

▌Reference

---

Best (and safest) way to merge a git branch into master

[Git] Checkout certain version of a file

 GIT   GitHub  

▌Checkout certain version of a file

---

▋View commit history

git log -p [FilePath-and-name]

PS. If you want to skip the diff message, skip –p

git log [FilePath-and-name]

Copy the commit hash.

▋Checkout

git checkout [Commit-hash] [FilePath-and-name]

[Git] Delete a remote branch

 GIT   GitHub  

▌Delete a remote branch

---

When I deleted the local branch by

git branch -d <BranchName>

, and wanna do push it.

git push origin : <BranchName>

The error message showed as following:

error: src refspec BranchWithEmailCheck does not match any.

The correct way:

git push origin --delete <BranchName>

▌Reference

---

Delete a Git branch both locally and remotely