Git Hooks, Conventional Commits, and Cryptographic Signing

Automating commit hygiene prevents broken builds and security leaks before code ever reaches remote CI/CD pipelines. This guide covers Client-Side Hooks (pre-commit, commit-msg), Conventional Commits, and Cryptographically Signed Commits (GPG / SSH keys).

⚡ Quick Dive

The Conventional Commits Specification

<type>(<optional scope>): <description>

[optional body]

[optional footer(s)]
Commit Type Purpose SemVer Impact
feat Introduces a new user-facing feature MINOR bump (0.1.0 $\to$ 0.2.0)
fix Patches a bug PATCH bump (0.1.0 $\to$ 0.1.1)
perf Code change that improves performance PATCH bump
refactor Code change that neither fixes a bug nor adds a feature None
BREAKING CHANGE Introduces breaking API changes MAJOR bump (1.0.0 $\to$ 2.0.0)

📖 Extended Guide

1. Cryptographically Signing Commits with SSH Keys

Modern Git (2.34+) supports signing commits with standard SSH keys (eliminating complex GPG keyrings):

# 1. Configure Git to use SSH for signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# 2. Enable automatic commit signing
git config --global commit.gpgsign true

# 3. Verify signed commits in git log
git log --show-signature -1
⌂ All Guides