VTRICKS TECHNOLOGIES
GIT and GitHub/GitLab Mastery
Collaborator access
A feature to let others work on your GitHub repository.
Private or team projects where multiple people need write access.
You invite users from Settings → Collaborators, assign permissions, and they can push, pull, and manage code
depending on the role.
Click on the settings of the repository, on the left panel click on the collaborators
Click on add people, add username or email id of the user
A invitation will be sent to the collaborator added through mail
VTRICKS TECHNOLOGIES
The collaborator needs to accept the invitation to access the git repo
Then in the collaborators account also he can see the same repo
VTRICKS TECHNOLOGIES
Now we can see that the collaborator is added to your account successfully
RULESET
Security and workflow enforcement rules for repositories.
When you want mandatory checks (e.g., no direct commits to main).
You create rules to enforce branch protection, required reviews, and code scanning before code is
merged.
Mandatory CI Checks: All automated status checks (like builds and tests) must pass before any code
can be merged into the protected branch.
Prevent History Rewrites: Force pushes are blocked to prevent anyone from overwriting the
branch's commit history and losing work.
Security Gate: Code scanning must be enabled and provide results (with no critical vulnerabilities)
before a merge is allowed.
Quality Gate: The merge can be blocked based on the severity of issues found by code quality analysis
tools.
Automated AI Review: An AI-powered code review from Copilot is automatically requested for new
pull requests.
Admin-Only Deletions: Only users with bypass permissions can delete the protected branch,
preventing accidental loss.
Mandatory Pull Requests: Direct pushes to the branch are blocked; all changes must be submitted
and approved via a pull request.
Verified Commits: All commits must be cryptographically signed to verify the author's identity and
ensure code integrity.
VTRICKS TECHNOLOGIES
Click on the create Rulesets, and provide an ruleset name
Choose the targets and bypass
VTRICKS TECHNOLOGIES
Then click on the rules, according to your requirement, click on the checkbox and then click on create
rule
VTRICKS TECHNOLOGIES
Then a rule will be created for this particular repo
Packages
GitHub’s storage for software packages and Docker images.
To host container images or libraries that your project needs.
You publish packages using GitHub Actions or CLI, and teams pull/use them directly from GitHub.
Think of it as an app store or a warehouse for your project's dependencies. It supports various common
package types, such as:
npm (JavaScript)
Docker (Container images)
Maven (Java)
NuGet (.NET)
RubyGems (Ruby)
These packages are stored alongside your code in GitHub repositories, enabling you to seamlessly share,
manage, and deploy your code and dependencies together in one place. They are integrated with GitHub's
security features and access controls.
First create a Github Token, Goto settings --> Developer settings --> Tokens (classic)
VTRICKS TECHNOLOGIES
Then click on Generate new token (classic)
Choose the write packages checkbox in scopes
VTRICKS TECHNOLOGIES
Then click on generate token
Copy the token generated
to see how the packeges work we will take a sample docker images follow the below
commands
mkdir docker-demo
cd docker-demo
echo '[Link]("Hello from Docker + GitHub Packages!");' > [Link]
nano Dockerfile ---> FROM node:18
WORKDIR /app
COPY . .
CMD ["node", "[Link]"]
git init
git commit -m "first commit"
git branch -M main
ssh-keygen -t rsa -b 4096 -C "[Link]"
cat /home/ubuntu/.ssh/id_rsa.pub --> add it in github secrets
git status
git add .
git commit -m "first commit"
git branch -M main
git remote add origin git@[Link]:USERNAME/[Link]
git push -u origin main
VTRICKS TECHNOLOGIES
cd ..
cd docker-demo/
git status
git push origin main
docker build -t [Link]/vtricksshiva/docker-demo:latest .
ubuntu@ip-172-31-21-60:~/docker-demo$ docker build -t [Link]/vtricksshiva/docker-demo:latest .
[+] Building 19.7s (8/8) FINISHED docker:default
=> [internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 95B 0.0s
=> [internal] load metadata for [Link]/library/node:18 0.3s
=> [internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [1/3] FROM
[Link]/library/node:18@sha256:c6ae79e38498325db67193d391e6ec1d224d96c693a8a4d943498556716
d3783 17.0s
=> => resolve
[Link]/library/node:18@sha256:c6ae79e38498325db67193d391e6ec1d224d96c693a8a4d943498556716
d3783 0.1s
B 1.8s
=> => sha256:37927ed901b1b2608b72796c6881bf645480268eca4ac9a37b9219e050bb4d84 24.02MB /
24.02MB 0.9s
=> => extracting sha256:461077a72fb7fe40d34a37d6a1958c4d16772d0dd77f572ec50a1fdc41a3754d
0.0s
=> [internal] load build context 0.1s
=> => transferring context: 30.92kB 0.0s
=> [2/3] WORKDIR /app 1.7s
=> [3/3] COPY . . 0.1s
=> exporting to image 0.4s
=> => exporting layers 0.2s
=> => exporting manifest sha256:7f3b244120dfde304ea8cc4c10df6c30c02c846704e1337cc32bf468fab19a9f
ubuntu@ip-172-31-21-60:~/docker-demo$ docker images
i Info → U In Use
IMAGE ID DISK USAGE CONTENT SIZE EXTRA
[Link]/vtricksshiva/docker-demo:latest 436ecaee661a 1.57GB 395MB
LOGIN WITH the token generated
echo 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 | docker login [Link] -u USERNAME --password-stdin
Push the images created to github
docker push [Link]/USERNAME/docker-demo:latest
The push refers to repository [[Link]/vtricksshiva/docker-demo]
461077a72fb7: Pushed
00add0ce0f61: Pushed
18c8e9b040b6: Pushed
37927ed901b1: Pushed
e23f099911d6: Pushed
33e7f494e12b: Pushed
3e6b9d1a9511: Pushed
79b2f47ad444: Pushed
cda7f44f2bdd: Pushed
c6b30c3f1696: Pushed
3697be50c98b: Pushed
latest: digest: sha256:436ecaee661a895d99e35727e9971c75b62e1480e93f02566b9127ee48d3f4f4 size: 856
VTRICKS TECHNOLOGIES
You can see a docker image pushed to the github repository
You can pull these images any time you need
VTRICKS TECHNOLOGIES
Create issue
GitHub’s bug and task tracking system.
Project management for bugs, tasks, and new features.
Create issues with titles, labels, and assignees; track progress until closed.
Think of them as a project's dedicated to-do list, discussion forum, and bug tracker combined. They are used to:
Report and track software bugs.
Propose new features and discuss them with the team.
Break down large tasks into manageable action items.
Collect community feedback and questions for open-source projects.
Each issue has a comments section for discussion and can be assigned to people, given labels, and linked to pull
requests, keeping all project-related conversation organized in one place.
Click on issues --> click on new issue
Choose assignee to whom does this issue should be assigned and choose the label
VTRICKS TECHNOLOGIES
Choose the project
Then click on create issue
VTRICKS TECHNOLOGIES
PROJECTS
Kanban-style project board inside GitHub.
Managing workflows (To Do → In Progress → Done).
Create a board, add tasks/issues as cards, move them through stage
Think of it as a spreadsheet, whiteboard, and automation tool combined, designed specifically for software
development workflows. It is used to:
Visualize and manage tasks from Issues and Pull Requests on a customizable board or table.
Track progress for features, sprints, or large-scale goals.
Automate workflows by setting rules to change status, assignees, or fields.
Provide a high-level overview of a project's health and what everyone is working on.
It essentially helps teams plan and coordinate their work beyond the scope of a single Issue or Pull Request.
Click on Project --> click on new project
Choose Kanban Dashboard
VTRICKS TECHNOLOGIES
Provide name of the Project then click on the create Project
Here you can create Backlogs, create issuses
View the Priority board depending upon issue priority
View the Team Items
VTRICKS TECHNOLOGIES
View Roadmap
FORK
A personal copy of someone else’s repository.
Open-source contributions or when you want to modify a repo you don't own.
You click Fork, get your own copy, make changes, and submit a pull request.
Think of it as making your own independent version of a project to experiment with freely. It is primarily used
to:
Propose changes to a project you don't have write access to.
Experiment with ideas or fixes without affecting the original codebase.
Contribute to open-source software by making changes in your fork and then submitting them back to the
original project via a Pull Request.
Your fork starts as an exact duplicate but exists as a separate, independent project that you can modify without
impacting the original "upstream" repository.
Search the required public repository and above the code you will be having fork option, click on that
You will be prompted to add the repository name, and provide the name then click on the fork
VTRICKS TECHNOLOGIES
You will be getting the same repo on your github account
Then you can make the changes to the repository and you can create the pull request
Then you can create the Pull requset after comparing the changes
VTRICKS TECHNOLOGIES
if there will be no conflicts present they can be merged, if there are any conflicts resolve the conflict and
merge the codes
VTRICKS TECHNOLOGIES
SECURITY & COMPLIANCE
Code Exposure: Git repositories contain intellectual property, credentials, and infrastructure details
Supply Chain Attacks: Compromised dependencies can affect entire software ecosystems
Compliance Requirements: Regulations like GDPR, HIPAA, SOC2 require secure code practices
Attack Vectors:
Committed secrets (API keys, passwords)
Vulnerable dependencies
Unverified commits (spoofing)
Malicious code injections
Security Principles
Least Privilege: Only necessary access rights
Defense in Depth: Multiple security layers
Audit Trail: Track all changes and access
Automated Scanning: Catch issues early
gitignore Security Patterns
# Create comprehensive .gitignore
nano .gitignore
# Critical security patterns to include
.env
*.pem
*.key
*.crt
*.csr
*.p12
*.pfx
*config*.json
*secret*
*password*
credentials*
aws-config*
[Link]
.vscode/
.idea/
*.log
VTRICKS TECHNOLOGIES
Commit Security
# Add and commit securely
git add .gitignore
git commit -m "Add security ignore patterns"
git push
# Signed commits for verification
git config --global [Link] <your-gpg-key>
git config --global [Link] true
git commit -S -m "Signed security commit"
GitHub Security Features (30 mins)
A. Secret Scanning
Purpose: Automatically detects committed secrets
Coverage: 200+ secret patterns (API keys, tokens, credentials)
Action: Enables push protection and alerts
B. Dependency Scanning
Dependency Graph: Maps project dependencies
Dependabot Alerts: Notifies about vulnerable dependencies
Automated Updates: Creates PRs for security updates
C. Code Scanning
CodeQL: GitHub's semantic code analysis engine
Third-party Tools: Integrate SAST tools
Workflow Integration: CI/CD pipeline scanning
ubuntu@ip-172-31-21-60:~/docker-demo$ sudo apt install gitleaks
Reading package lists... Done
Building dependency tree... Done
Scanning linux images...
Running kernel seems to be up-to-date.
No services need to be restarted.
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.
ubuntu@ip-172-31-21-60:~/docker-demo$ gitleaks detect .
○
│╲
│○
○░
░ gitleaks
9:38AM INF 1 commits scanned.
9:38AM INF scan completed in 62.4ms
9:38AM INF no leaks found