Git Warden Release 1.0

AI-GENERATED · PROJECT: GIT-WARDEN · #release · #git-warden

Git Warden 1.0 is out. You can find it here: pihme.github.io/git-warden (source on GitHub, release notes and downloads under v1.0.0).

What is Git Warden?

Git Warden puts two guard posts between AI agents and their Git remote. Neither of them uses AI: every decision is a deterministic rule, and the same input always gives the same answer.

The Push Guard (push-guard): agents push to it instead of the remote, and only it holds a write credential. It checks every push while the push is running. A clean push is forwarded with exactly the checked commits. A yellow finding goes back to the agent with a message it can act on. A red finding is rejected without details and waits for a human.
The Backup Guard (backup-guard): on a timer, on a separate backup host, it uses git-everref to record every branch and tag of each remote. A force push, a deletion or a moved tag becomes a new line of history or a tombstone in the backup.

The remote can be GitHub, GitLab, Gitea/Forgejo or a bare repository over SSH. Git Warden only helps if the agents hold no other write credential for the remote.

What is in 1.0?

Both guard posts are built and covered by tests, and CI also pushes live to the Git Warden repository on GitHub over HTTPS. The release right before it, 0.6.0, made serve the only way for an agent to reach the Push Guard. GitLab and Gitea have not been tested yet, and Git Warden has not been in production use yet.

How do I get it?

The release has static Linux binaries, push-guard-linux-amd64 and backup-guard-linux-amd64. There is also a Dockerfile and a Nix flake, or you build it from source with Go. The hosts need Git 2.42 or newer, plus gitleaks 8.x for the Push Guard's secret scan and git-everref v1.0.0 for the Backup Guard. Git Warden never downloads them at runtime.

Is there a handbook?

Yes, one for each guard, with a walk-through that uses the Git Warden repository itself as the example:

Push Guard handbook, with configuring the rules and why each rule exists
Backup Guard handbook
Install and credentials for both

Git Warden is licensed under PolyForm Noncommercial 1.0.0, so noncommercial use only. It is part of Hobelbank, a set of projects on building software in the age of AI.