managing-git-workflows — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited managing-git-workflows (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Implement structured Git workflows for team collaboration, code quality, and automated releases. This skill covers branching strategies, conventional commit formats, Git hooks, and monorepo management patterns.
Use this skill when:
Use when the team has strong CI/CD automation, comprehensive test coverage (80%+), and deploys frequently (daily or more). Short-lived branches merge within 1 day. Requires feature flags for incomplete features.
Best for: High-velocity teams with mature DevOps practices (Google, Facebook, Netflix)
Use for web applications with continuous deployment. Main branch always represents production. Simple PR-based workflow for small to medium teams (2-20 developers).
Best for: Startups, SaaS products, open-source projects
Use when supporting multiple production versions simultaneously, requiring formal QA cycles, or following scheduled releases (monthly, quarterly). More complex but structured.
Best for: Enterprise software, mobile apps with App Store releases, on-premise products
For detailed branching patterns with examples, see references/branching-strategies.md.
Structure commit messages for automated versioning and changelog generation:
<type>[optional scope]: <description>
[optional body]
[optional footer(s)]Common Types:
feat - New feature (MINOR version bump: 0.1.0)fix - Bug fix (PATCH version bump: 0.0.1)docs - Documentation onlyrefactor - Code restructuring without feature changetest - Adding or updating testschore - Maintenance tasksBreaking Changes:
! after type: feat!: or fix!:BREAKING CHANGE: in footerExamples:
git commit -m "feat(auth): add JWT token validation"
git commit -m "fix: resolve race condition in user login"
git commit -m "feat!: redesign authentication API
BREAKING CHANGE: Auth endpoints now require API version header"For complete specification and tooling setup, see references/conventional-commits.md.
Automate code quality checks at key workflow points:
pre-commit - Run before commit is created
commit-msg - Validate commit message format
pre-push - Run before pushing to remote
Quick Setup with Husky:
npm install --save-dev husky lint-staged @commitlint/cli @commitlint/config-conventional
npx husky init
npx husky add .husky/pre-commit "npx lint-staged"
npx husky add .husky/commit-msg 'npx --no -- commitlint --edit $1'For complete hook configuration and examples, see references/git-hooks-guide.md.
Nx - Best for TypeScript/JavaScript monorepos
Turborepo - Best for Next.js/React applications
Sparse Checkout - For large repos when full clone not needed
git sparse-checkout init --cone
git sparse-checkout set apps/web libs/ui-componentsUse .github/CODEOWNERS to define ownership:
# Default owners
* @org/engineering
# Apps ownership
/apps/web/ @org/web-team
/apps/mobile/ @org/mobile-team
# Security-critical
/libs/auth/ @org/security-team @org/principal-engineersFor detailed monorepo patterns, see references/monorepo-patterns.md.
Use when preserving complete history is important:
git checkout main
git merge feature-branchWhen: Multiple developers on feature branch, want to see integration point
Use for clean, linear history:
git checkout main
git merge --squash feature-branch
git commit -m "feat: add user authentication"When: Feature has many WIP commits, want clean main branch history
Use for linear history without merge commits:
git checkout feature-branch
git rebase mainWhen: Updating feature branch, working alone, cleaning up before PR
⚠️ Never rebase: Public branches (main, develop) or commits already pushed and used by others
Create .github/PULL_REQUEST_TEMPLATE.md:
## Description
<!-- Brief description of changes -->
## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update
## Checklist
- [ ] Code follows style guidelines
- [ ] Self-reviewed code
- [ ] Added tests
- [ ] Updated documentation
- [ ] Tests pass locallyEnforce quality gates via repository settings:
For complete code review setup, see references/code-review-workflows.md.
Use consistent naming for clarity:
feature/user-authentication - New featuresbugfix/login-error - Bug fixeshotfix/critical-security-issue - Urgent production fixesdocs/api-documentation - Documentation changesrefactor/database-layer - Code refactoringValidate branch names with Git hooks (see scripts/check-branch-name.sh).
Apply specific commits to other branches:
git checkout main
git commit -m "fix: resolve critical security issue"
# Commit hash: a1b2c3d
git checkout release/1.5
git cherry-pick a1b2c3dTrack large files separately from code:
git lfs install
git lfs track "*.psd"
git lfs track "*.mp4"
git add .gitattributesMark production releases:
git tag -a v1.2.0 -m "Release version 1.2.0"
git push origin v1.2.0Clean up commit history before PR:
git rebase -i HEAD~3
# Squash WIP commits, reword messages, reorder commitsFor detailed examples, see examples/ directory.
Combine conventional commits with CI/CD for automated versioning:
See examples/semantic-release-setup/ for complete configuration.
Git Hooks:
Commit Validation:
Monorepo Build:
Large Files:
All tools validated via Context7 with high trust scores (December 2025).
building-ci-pipelines - Git workflows trigger CI/CD pipelines, branch protection enforces CI checks
writing-github-actions - GitHub Actions automate workflow steps (releases, PR checks)
infrastructure-as-code - IaC repos need structured workflows, GitOps uses Git as source of truth
testing-strategies - Git hooks enforce test requirements, pre-push runs test suites
security-hardening - Git hooks prevent secrets, signed commits verify identity, CODEOWNERS enforce security reviews
git checkout -b feature/add-login main
git add .
git commit -m "feat: add login form component"
git rebase origin/main # Stay up to date
git push origin feature/add-login
# PR → merge → delete branch (within 24 hours)git checkout -b feature/user-auth main
git commit -m "feat: add JWT authentication"
git commit -m "test: add auth tests"
git push origin feature/user-auth
# Open PR → review → merge → deploy → delete branch# Feature
git checkout -b feature/user-profile develop
git commit -m "feat: add user profile"
git checkout develop
git merge --no-ff feature/user-profile
# Release
git checkout -b release/1.1.0 develop
git checkout main
git merge --no-ff release/1.1.0
git tag -a v1.1.0 -m "Release 1.1.0"
# Hotfix
git checkout -b hotfix/critical-bug main
git checkout main
git merge --no-ff hotfix/critical-bug
git tag -a v1.1.1 -m "Hotfix 1.1.1"Run automated checks:
scripts/validate-commit-msg.sh - Validate commit message formatscripts/check-branch-name.sh - Validate branch naming conventionscripts/setup-hooks.sh - Automated hook installationExecute scripts directly (token-free) for validation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.