repo-git-identity

name	repo-git-identity
description	Enforce the required repo-local Git and GitHub identity for this repository. Use when: committing, amending, rebasing, force-pushing, closing issues, using gh, or doing any authenticated GitHub operation for hora-prathinidhi.

Repo Git Identity

When to Use

• Any git commit, rebase, amend, or history rewrite in this repo
• Any push, force-push, fetch with auth, or GitHub API action for this repo
• Any gh or issue/PR/comment operation tied to this repo

Required Identity

• Commit author and committer must match the repo-local app or bot identity configured in .git/config
• Authenticated GitHub operations must use the repo-local GitHub App flow for the current machine — never a personal default gh session

Repo-Local Setup

• .git/config must contain:
  • user.name — the repo-local app or bot identity
  • user.email — the app's no-reply email or a bot-scoped address
  • user.useConfigOnly = true
  • credential.helper — wired to the repo-local credential helper script under .git/helpers/
• Helpers live in .git/helpers/ (gitignored, never committed):
  • .git/helpers/gh-app — wrapper for gh CLI (injects app GH_TOKEN)
  • .git/helpers/optacbook-auth.mjs — git credential helper (auto-generates installation tokens)
  • .git/helpers/get-token.mjs — standalone token generator (prints token to stdout)
  • The app's private .pem key (mode 600)
• Treat bare gh as unsafe on every machine; global gh may still be logged into personal accounts, so repo work must always use the wrapper instead of relying on machine-global auth state
• Do not hardcode any specific app name, App ID, email, or key filename in tracked repo files

Procedure

1. Before creating commits: git config --local --get-regexp '^user\.'
2. For gh CLI work: .git/helpers/gh-app <subcommand> — never bare gh
3. For authenticated git transport: the local credential helper auto-generates app tokens
4. Before push: git log --format=fuller -1 — must match the repo-local identity from .git/config
5. If commit identity is wrong: stop, rewrite, never push with wrong author

Push Rules

• All git push / git pull operations work through the local credential helper
• All gh operations for this repo must go through .git/helpers/gh-app
• If force-pushing, use --force-with-lease against the known remote SHA

Recovery

• Wrong identity local only → amend or rebase before push
• Wrong identity landed on main → rewrite, force-push with lease, verify issue/PR state

Verification

• git log --format=fuller -1 matches the repo-local user.name and user.email from .git/config
• .git/helpers/gh-app auth status shows the repo-local bot account (not a personal account)
• git fetch origin succeeds (credential helper generates token)
• If gh auth status is checked for audit only, treat any personal login as proof that bare gh remains unsafe rather than as repo auth proof