dotfiles/dot_gitconfig.tmpl at main · sanchpet/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# Git identity. Personal (sanchpet) is the default everywhere, with SSH commit
# signing whenever the signing key is present. A machine that also does corporate
# work sets work.* in its machine-local chezmoi data; the includeIf at the bottom
# then switches to that identity (signing off) for repos under work.gitdir.
[user]
	name = sanchpet
	email = petrov@sanch.pet
{{- /* Commit-signing key. With the Bitwarden SSH agent (data.bitwarden.agent) the       */ -}}
{{- /* private signing key lives in the vault and is served over the agent socket, so we  */ -}}
{{- /* point git at the signing@personal PUBLIC key (key:: literal) to select that agent  */ -}}
{{- /* identity. Without the agent, fall back to this machine's on-disk per-machine key.  */ -}}
{{- /* agent.kind picks the vault that serves this machine's keys; agent.signingKey is that   */ -}}
{{- /* machine's signing PUBLIC key. Legacy machines only set bitwarden.agent, so fall back   */ -}}
{{- /* to it and to the shared signing@personal key. No private key is ever kept on disk.     */ -}}
{{- $agent := dig "agent" "kind" "" . }}
{{- if and (not $agent) (dig "bitwarden" "agent" false .) }}{{ $agent = "bitwarden" }}{{ end }}
{{- $signKey := dig "agent" "signingKey" "" . }}
{{- if and (eq $agent "bitwarden") (not $signKey) }}{{ $signKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnwqHSKmXOt1E0jPvBCAmxvpujzZrvPwDRk5Gvg83s+" }}{{ end }}
{{- if $signKey }}
	signingkey = key::{{ $signKey }}
{{- end }}
{{- if $signKey }}
[gpg]
	format = ssh
[gpg "ssh"]
	# Trust our own signing key so `git log --show-signature` / verify-commit
	# report Verified locally. Signers listed in allowed_signers.
	allowedSignersFile = {{ .chezmoi.homeDir }}/.config/git/allowed_signers
	# Sign via a shim that forces this machine's vault agent socket. Non-login
	# shells (Claude Code, background agents, scripts) don't source ~/.zshrc and
	# so miss the SSH_AUTH_SOCK redirect, leaving them unable to reach the vault
	# signing key; the shim fixes signing everywhere without touching ssh auth.
	program = {{ .chezmoi.homeDir }}/.local/bin/git-agent-sign
[commit]
	gpgsign = true
[tag]
	gpgsign = true
{{- end }}
[push]
	default = simple
	# Push a submodule's own commits before the superproject commit referencing
	# them. Otherwise the pointer names a ref the submodule remote never saw and
	# every other clone fails its fetch with "upload-pack: not our ref".
	recurseSubmodules = on-demand
# Default `git pull` to rebase instead of merge, so pulling a shared branch
# replays local commits on top rather than creating a merge bubble. autoStash
# lets it run with a dirty worktree (stash → rebase → pop).
[pull]
	rebase = true
[rebase]
	autoStash = true
# `git ci` = commit with a Signed-off-by trailer. Plain `git commit` and the
# oh-my-zsh `gc`/`gcmsg` shortcuts don't go through this alias — those shell
# shortcuts are overridden with --signoff in ~/.zshrc instead.
[alias]
	ci = commit -s
	# Colored one-line graph log — delta styles diffs, this styles history.
	lg = log --graph --date=short --pretty=format:'%C(auto)%h %ad %s%d %C(blue)[%an]'

# delta: syntax-highlighting pager for diffs (installed via mise).
[core]
	pager = delta
[interactive]
	diffFilter = delta --color-only
[delta]
	navigate = true       # use n / N to jump between diff sections
	dark = true
	side-by-side = true
	line-numbers = true
[merge]
	conflictStyle = zdiff3

{{- $workEmail := dig "work" "email" "" . }}
{{- $workGitdir := dig "work" "gitdir" "" . }}
{{- if $workEmail }}
{{-   if not $workGitdir }}
{{-     fail "work.email is set but work.gitdir is empty. Git reads an empty `gitdir:` pattern as a match on EVERY repository, so the corporate identity would become the global default and commit signing would be switched off everywhere — silently. Set work.gitdir (corporate repo dir, trailing slash) in ~/.config/chezmoi/chezmoi.toml, or clear work.email." }}
{{-   end }}
# Corporate repos live under work.gitdir; override to the work identity and turn
# signing off there (see work.inc). Everything else stays personal and signed.
# Both values are required: see the guard above for why a blank gitdir is refused.
[includeIf "gitdir:{{ $workGitdir }}"]
	path = ~/.config/git/work.inc
{{- end }}