git-sync-all: Security
Security-relevant behaviour of git-sync-all: auto-commit with git add -A, push without prompt, deletion in --verify, config as shell script, lock file and credentials.
git-sync-all: Security
This page summarizes which operations can change or delete data and what you can do about it.
What the tool does not do
- It never pushes with
--forceand does not rewrite published history. - It does not switch branches and does not run
git resetorgit clean. - It does not push tags.
- It does not store credentials. Pull and push use your existing Git setup (SSH agent, credential helper).
Operations with effect
| Operation | When | Protection |
|---|---|---|
git add -A and git commit |
On changes in the working tree, after a prompt or with --yes |
--dry-run, --no-commit, .gitignore |
git push <remote> <branch> |
When local commits are ahead of the upstream | --no-push, --dry-run |
git pull --rebase or git pull |
When the upstream has new commits | Automatic abort of rebase and merge on errors, --no-pull |
git stash push --include-untracked and git stash pop |
Stash path, --no-commit with remote changes |
On pop conflicts the changes stay in the stash |
git fetch --tags --prune-tags |
Per repository while tags are enabled | --no-tags. Deletes local tags only with fetch.prune=true or remote.<name>.prune=true |
rm -rf <repository> |
Only with --verify and y |
Per-repository prompt, ignores --yes, not without a terminal, not in dry run |
Auto-commit takes everything
git add -A stages every changed file and every untracked file that .gitignore does not exclude. If your working tree contains credentials, .env files or large binaries that are not ignored, they end up in the commit and on push in the remote. With --yes or SYNC_AUTO_CONFIRM=true there is no prompt and no look at the file list. Check your .gitignore files before the first unattended run and start with --dry-run.
Deletion in --verify
--verify can delete whole repository directories that are not in the inventory. Unpushed commits and uncommitted files are lost. Answer y only when you are sure the repository is expendable. See Inventory for details.
The config file is executed
The config file is loaded with source, a shell script running with your privileges. Use --config only with files you trust, and make sure nobody else can write to the file.
Lock file
The tool creates ${XDG_RUNTIME_DIR:-/tmp}/git-sync-all.lock containing its PID and removes it on exit. If an instance is running, the second one exits with an error. A stale lock file (PID no longer running) is removed automatically. Without XDG_RUNTIME_DIR the file lives in /tmp, a directory all local users can write to.
A second instance that exits because the first one is running deletes the first instance's lock file on exit. A third instance can then start although the first one is still running. The lock therefore does not reliably prevent parallel runs.
Network access
The tool talks only to the Git remotes of the repositories. Only --issues and the clone hints of --verify additionally call the GitHub CLI gh (gh auth status, gh issue list, gh api user).
Recommendations
- Test new setups with
--dry-run. - For cron, use a dedicated config with
SYNC_AUTO_CONFIRM=trueandSYNC_CONFLICT_STRATEGY="skip". - With
--no-commit --no-pushthe run stays at fetch and pull, but a temporary stash is created when the remote has changes. - Check failed stash pops in the repository with
git stash list.