| name | git-investigation |
| description | This skill should be used when the user asks to "use git blame", "check git history", "find git commits", "use git log", "use git diff", "use git bisect", "trace code changes", "find who changed this code", or mentions using git commands for investigating code history and changes during root cause analysis. Use when this capability is needed. |
| metadata | {"author":"evangelosmeklis"} |
Git Investigation
Overview
Git is a distributed version control system that tracks code changes over time. This skill provides guidance for using git commands to investigate code history, identify when bugs were introduced, and track down specific changes during root cause analysis.
When to Use This Skill
Apply this skill when:
- Tracing when specific code was changed
- Finding who authored problematic code
- Identifying commits that introduced bugs
- Comparing code versions before/after incidents
- Searching commit messages for clues
- Binary searching for breaking commits (bisect)
Essential Git Commands for RCA
git log - View Commit History
Basic usage:
git log
Useful flags for RCA:
Show commits with diffs:
git log -p
Show commits for specific file:
git log -- path/to/file.js
Show commits in time range:
git log --since="2025-12-19 00:00" --until="2025-12-19 23:59"
Show one-line summaries:
git log --oneline
Show commits by author:
git log --author="Developer Name"
Show commit graph:
git log --graph --oneline --all
Search commit messages:
git log --grep="database" --grep="pool" --all-match
Format output:
git log --format="%h %an %ad %s" --date=short
git blame - Find Line Authors
Basic usage:
git blame path/to/file.js
Show line ranges:
git blame -L 40,50 path/to/file.js
Show email addresses:
git blame -e path/to/file.js
Follow line history through renames:
git blame -C -C -C path/to/file.js
Show commit details:
git blame -s path/to/file.js
Blame output format:
abc123de (Developer Name 2025-12-19 10:15:00 +0000 45) max: 10,
abc123de: Commit SHADeveloper Name: Author2025-12-19 10:15:00: Timestamp45: Line numbermax: 10,: Code content
git diff - Compare Versions
Compare working directory with last commit:
git diff
Compare specific commits:
git diff commit1 commit2
Compare file across commits:
git diff commit1 commit2 -- path/to/file.js
Compare with previous commit:
git diff HEAD~1 HEAD
Show diff for specific commit:
git show commit_sha
Unified diff with context:
git diff -U5
Word-level diff:
git diff --word-diff
git show - View Commit Details
Show complete commit:
git show commit_sha
Show specific file in commit:
git show commit_sha:path/to/file.js
Show commit metadata only:
git show --stat commit_sha
git bisect - Binary Search for Breaking Commit
Use when: You know code worked at one point and is broken now, but don't know which commit broke it.
Workflow:
- Start bisect:
git bisect start
- Mark current as bad:
git bisect bad
- Mark known good commit:
git bisect good commit_sha
-
Test current code (git checks out midpoint)
- Run tests or reproduce bug
- If broken:
git bisect bad
- If working:
git bisect good
-
Repeat until git identifies first bad commit
-
End bisect:
git bisect reset
Automated bisect:
git bisect start HEAD v1.0
git bisect run ./test-script.sh
Test script should exit 0 for good, non-zero for bad.
Git Investigation Workflows
Workflow 1: Find When Line Changed
Goal: Identify when specific line was last modified
Steps:
- Use blame to find commit:
git blame path/to/file.js | grep "suspicious code"
-
Extract commit SHA from blame output
-
View commit details:
git show commit_sha
- Review commit message, author, timestamp, and changes
Workflow 2: Track File History
Goal: See all changes to a file over time
Steps:
- View commit history for file:
git log -p -- path/to/file.js
- Focus on time range around incident:
git log --since="2025-12-18" --until="2025-12-19" -- path/to/file.js
- Review each commit's diff to identify suspicious changes
Workflow 3: Find Recent Changes to Multiple Files
Goal: Identify recent commits affecting several related files
Steps:
- List recent commits with file stats:
git log --since="2025-12-19" --stat
- Filter commits touching specific directory:
git log --since="2025-12-19" -- src/config/
- Look for commits near incident time that modified relevant files
Workflow 4: Search Commit Messages
Goal: Find commits related to specific feature or bug
Steps:
- Search commit messages:
git log --grep="database" --grep="connection" --all-match
- Or search for any of multiple terms:
git log --grep="database\|connection\|pool"
- Review matching commits for relevance
Workflow 5: Compare Working vs Deployed Version
Goal: Identify differences between deployed and current code
Steps:
- Find deployed commit SHA (from deployment logs or tags):
deployed_sha="abc123"
- Compare with current code:
git diff $deployed_sha HEAD
- Or compare specific file:
git diff $deployed_sha HEAD -- path/to/file.js
- Review differences for potential issues
Workflow 6: Binary Search for Breaking Commit
Goal: Find exact commit that introduced bug
Steps:
- Identify known-good commit (e.g., last working version):
git log --oneline
- Start bisect:
git bisect start
git bisect bad
git bisect good good_commit_sha
-
Test each checkout:
- Reproduce issue or run tests
- Mark as
git bisect good or git bisect bad
-
Git identifies first bad commit
-
Review that commit to find root cause
Advanced Git Techniques
Finding Deleted Code
Search for deleted lines:
git log -S "deleted code pattern" --all
Example - Find when "max: 100" was removed:
git log -S "max: 100" -- src/config/database.js
Following Renames
Track file across renames:
git log --follow -- path/to/file.js
Blame with rename detection:
git blame -C -C -C path/to/file.js
Finding Large Changes
Show commits by diff size:
git log --stat --format="%h %s" | head -20
Find commits with many changes:
git log --shortstat | grep -E "file.*change"
Checking Specific Commit
View commit details:
git show commit_sha
View files changed in commit:
git show --name-only commit_sha
View commit as patch:
git format-patch -1 commit_sha
Interpreting Git Output
Git Blame Output
abc123de src/config/database.js (Developer Name 2025-12-19 10:15:00 +0000 45) max: 10,
Extract:
- Commit:
abc123de
- File:
src/config/database.js
- Author:
Developer Name
- Date:
2025-12-19 10:15:00
- Line:
45
- Code:
max: 10,
Action: Check if timestamp correlates with incident start.
Git Log Output
commit abc123def456789
Author: Developer Name <dev@example.com>
Date: Thu Dec 19 10:15:00 2025 +0000
Refactor database configuration
Align pool size with staging environment
Extract:
- Full SHA:
abc123def456789
- Author:
Developer Name <dev@example.com>
- Date:
Thu Dec 19 10:15:00 2025
- Message: Multi-line commit message
Red flags:
- Vague messages: "fix bug", "update code"
- Large refactors near incident time
- Config changes without explanation
Git Diff Output
@@ -42,7 +42,7 @@ function createConnectionPool() {
return new Pool({
host: process.env.DB_HOST,
port: process.env.DB_PORT,
- max: 100,
+ max: 10, // Align with staging
min: 10,
idleTimeoutMillis: 30000
});
Interpret:
- line: Old code (removed)+ line: New code (added)@@ -42,7 +42,7 @@: Line numbers (start at line 42, 7 lines shown)
Identify issue: max: 100 → max: 10 is likely problematic reduction.
Best Practices
Do:
- Use time ranges to focus on relevant commits
git log --since="2025-12-19 00:00" --until="2025-12-19 23:59"
- Filter by file/directory to reduce noise
git log -- src/config/
- Combine flags for precise queries
git log --author="Developer" --since="1 week ago" -- src/
- Use grep to search commit messages
git log --grep="database"
- Follow renames when tracking file history
git log --follow -- file.js
- Use bisect for efficient debugging
git bisect start HEAD v1.0.0
Don't:
- Run
git log without filters (too much output)
- Ignore commit messages (valuable clues)
- Forget time context (correlate with incident time)
- Skip reading full diffs (may miss subtle bugs)
- Blame individuals (focus on system improvements)
Integration with Thufir
This skill integrates with:
- root-cause-analysis skill: Git provides evidence for RCA
- platform-integration skill: Complements GitHub/GitLab API data
- RCA agent: Agent uses git commands via Bash tool
Using Git in RCA Agent
Agent can execute git commands:
git log --since="24 hours ago" --oneline -- src/config/database.js
git blame -L 45,45 src/config/database.js
git show abc123
git diff HEAD~1 HEAD -- src/config/database.js
Agent parses output to extract commit SHAs, authors, timestamps, and changes.
Common Patterns
Pattern 1: Stack Trace Points to File
- Extract file and line from stack trace
- Use
git blame on that file/line
- Identify commit that last touched it
- Use
git show to review commit
- Correlate commit time with incident
Pattern 2: Config Change Suspected
- List recent commits to config files:
git log --since="1 week ago" -- config/ src/config/
- Review each commit's diff:
git show commit_sha
- Identify config value changes
- Correlate changes with incident symptoms
Pattern 3: Recent Deployment Broke Code
- Find deployed commit (from deployment logs)
- Compare with previous deployment:
git diff previous_commit deployed_commit
- Review all changes in that diff
- Identify suspicious changes
- Test hypothesis by reverting specific changes
Pattern 4: Bug Introduced Sometime Ago
- Identify known-good version
- Use git bisect:
git bisect start HEAD good_commit
git bisect run ./test-reproduction.sh
- Git identifies first bad commit
- Review that commit for root cause
Additional Resources
Reference Files
For advanced git techniques:
references/git-aliases.md - Useful git aliases for RCAreferences/git-workflows.md - Complete RCA investigation workflows
Example Files
Working examples:
examples/bisect-script.sh - Sample automated bisect script
Quick Reference
Recent commits: git log --since="1 day ago" --oneline
Blame line: git blame -L 45,45 file.js
Show commit: git show abc123
Diff commits: git diff commit1 commit2
Search messages: git log --grep="pattern"
File history: git log -p -- file.js
Binary search: git bisect start HEAD good_commit
Correlate timestamps: Always compare git timestamps with incident timeline
Follow renames: Use --follow flag for moved files
Read full diffs: Don't just trust commit messages
Master git investigation techniques to efficiently trace code history and identify exact commits that introduced production issues.
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
