Git Security

Description

Secure a Git repository and its supply chain - commit signing with SSH or GPG (setup, vigilant mode, requiring signed commits), secret scanning (Gitleaks pre-commit hooks and CI, GitHub secret scanning and push protection), what to do in order when a secret is committed, Dependabot and Renovate (grouping, schedules, safe auto-merge, keeping action pins current), workflow permission and pinning basics, CODEOWNERS as a security boundary, branch protection, and a runbook for a suspected repository compromise. Use whenever the user hardens a repo, sets up signing, secret scanning, Dependabot or Renovate, asks about CODEOWNERS or branch protection for security, committed or pushed a secret, sees "Unverified" commits, or suspects unauthorized access to a repository.