Git & GitHub

You can explain what problem Git solves and why distributed version control replaced what came before.

1. Life before version control1 hr
   • dated folders
   • file locking
   • lost work
   • no attribution
   • merge by hand
2. Centralised versus distributed1 hr
   • SVN model
   • Git model
   • offline work
   • full local history
   • single point of failure
3. Installing and configuring Git1 hr
   • installation
   • user.name and email
   • default branch
   • editor config
   • credential helpers
4. The repository, working tree and index1 hr
   • three areas
   • what git init creates
   • the .git directory
   • tracked vs untracked
   • ignoring files
5. Your first commits1 hr
   • git add
   • git commit
   • commit messages
   • git status reading
   • git log basics
6. Getting help and reading documentation1 hr
   • git help
   • man pages
   • error message literacy
   • official docs
   • when to search

Hands-on project: Reconstruct a week of changes to a project kept in dated folders, and write up every failure mode that approach has.

You can explain what a commit actually is, which turns every confusing Git situation into something you can reason about.

1. The object database1 hr
   • blobs
   • trees
   • commits
   • tags
   • content addressing
2. SHA hashes and immutability1 hr
   • hashing content
   • why history is immutable
   • rewriting creates new objects
   • integrity
   • short hashes
3. Refs, HEAD and branches as pointers1 hr
   • refs directory
   • HEAD
   • branch as a pointer
   • detached HEAD
   • symbolic refs
4. The commit graph1 hr
   • parent pointers
   • merge commits
   • ancestry
   • reachability
   • orphaned commits
5. Plumbing versus porcelain1 hr
   • hash-object
   • cat-file
   • update-ref
   • write-tree
   • commit-tree
6. Garbage collection and packfiles1 hr
   • loose objects
   • packing
   • gc behaviour
   • unreachable objects
   • repository size

Hands-on project: Build a commit by hand using plumbing commands only, then inspect the object database to show what you created.

You can find out who changed what and why in a repository you have never seen before.

1. Writing commits worth reading1 hr
   • atomic commits
   • subject line
   • body explaining why
   • conventional commits
   • commit granularity
2. Reading history effectively1 hr
   • log formatting
   • graph view
   • filtering by path
   • date and author filters
   • following renames
3. Diffs in depth1 hr
   • unified diff format
   • staged vs unstaged
   • word diff
   • ignoring whitespace
   • diff between branches
4. Blame, bisect and archaeology1 hr
   • git blame
   • ignoring reformat commits
   • git bisect
   • automated bisect
   • finding the introducing commit
5. Searching the repository1 hr
   • git grep
   • log -S pickaxe
   • log -G regex
   • searching deleted code
   • case studies
6. Tags and releases1 hr
   • lightweight vs annotated
   • semantic versioning
   • signing tags
   • release association
   • tag hygiene

Hands-on project: Investigate an unfamiliar repository to find when a specific bug was introduced, by whom, and in which release.

You can work on several things at once without stepping on anyone, and resolve a conflict without fear.

1. Creating and switching branches1 hr
   • branch creation
   • switch and checkout
   • tracking branches
   • naming conventions
   • deleting branches
2. Fast-forward and three-way merges1 hr
   • fast-forward
   • merge commit
   • no-ff
   • merge base
   • ort strategy
3. Resolving conflicts1.5 hrs
   • conflict markers
   • choosing sides
   • manual resolution
   • mergetool
   • aborting
4. Semantic conflicts1 hr
   • clean merge wrong result
   • test after merge
   • API drift
   • communication
   • detection strategy
5. Stashing and switching context0.5 hr
   • stash push
   • stash pop
   • stash list
   • untracked files
   • worktrees as an alternative
6. Comparing and cherry-picking1 hr
   • cherry-pick
   • conflict during pick
   • range picking
   • when to cherry-pick
   • duplication risk

Hands-on project: Resolve six conflicts of increasing difficulty, including a semantic conflict where both sides merge cleanly but the result is broken.

You can produce a clean, reviewable history and know precisely when rewriting is dangerous.

1. Rebase versus merge1 hr
   • replaying commits
   • linear history
   • when each is right
   • team policy
   • the merge debate
2. Interactive rebase1.5 hrs
   • pick
   • reword
   • squash and fixup
   • edit
   • reorder
3. Autosquash and fixup workflow1 hr
   • commit --fixup
   • rebase --autosquash
   • review-driven fixups
   • keeping branches clean
   • aliases
4. The golden rule of rewriting1 hr
   • shared branch danger
   • force-with-lease
   • coordinating a rewrite
   • protected branches
   • recovery for others
5. filter-repo and large rewrites0.5 hr
   • removing a file from history
   • secret removal
   • repository splitting
   • coordination cost
   • consequences
6. Recovering from a bad rebase1 hr
   • reflog
   • ORIG_HEAD
   • reset --hard to reflog
   • lost commits
   • confidence through practice

Hands-on project: Turn a messy twenty-commit branch into five logical commits with interactive rebase, keeping the final tree byte-identical.

You can recover from any Git mistake, which is the skill that removes fear from everything else.

1. Reset: soft, mixed and hard1 hr
   • reset semantics
   • moving HEAD
   • staging effects
   • working tree effects
   • choosing the mode
2. Revert for shared history1 hr
   • revert commit
   • reverting a merge
   • revert chains
   • why revert over reset
   • communicating
3. Restore and checkout for files1 hr
   • restore working tree
   • restore staged
   • from a specific commit
   • discarding changes
   • safety
4. The reflog as a safety net1 hr
   • reflog reading
   • recovering deleted branches
   • after bad reset
   • expiry
   • per-ref reflog
5. Recovering unreachable commits1 hr
   • fsck dangling
   • cherry-picking back
   • stash recovery
   • gc timing
   • last resorts
6. Clean, rm and removing files safely1 hr
   • git clean -n
   • removing tracked files
   • keeping local copies
   • gitignore after the fact
   • accidental deletion recovery

Hands-on project: Recover from eight destructive scenarios including a hard reset, a deleted branch, a bad force push and an amended shared commit.

You can reason about what is on your machine versus the server, and never be surprised by a push rejection again.

1. Remotes and tracking branches1 hr
   • remote add
   • origin and upstream
   • remote-tracking refs
   • tracking configuration
   • multiple remotes
2. Fetch versus pull1 hr
   • fetch semantics
   • pull as fetch plus merge
   • pull --rebase
   • default configuration
   • avoiding surprise merges
3. Push, rejection and diverged branches1 hr
   • non-fast-forward
   • force vs force-with-lease
   • push options
   • deleting remote branches
   • push rules
4. Forks and upstream synchronisation1 hr
   • fork model
   • upstream remote
   • syncing a fork
   • contributing back
   • fork drift
5. Shallow clones, sparse checkout and large repos1 hr
   • shallow clone
   • partial clone
   • sparse checkout
   • LFS basics
   • CI clone cost
6. Working with multiple remotes and mirrors1 hr
   • multiple remotes
   • mirror push
   • migrating hosts
   • remote pruning
   • URL rewriting

Hands-on project: Work through ten remote scenarios including diverged branches, rejected pushes, upstream deletions and a force push you have to recover from.

You can run the collaboration side of a repository, not just the Git side.

1. Repository setup and settings1 hr
   • visibility
   • default branch
   • templates
   • topics
   • archiving
2. Issues, labels and milestones1 hr
   • issue templates
   • label taxonomy
   • milestones
   • assignment
   • triage workflow
3. Projects and planning1 hr
   • project boards
   • custom fields
   • views and filters
   • automation
   • roadmap use
4. Discussions, wikis and documentation1 hr
   • discussions vs issues
   • wiki use
   • README structure
   • CONTRIBUTING
   • CODE_OF_CONDUCT
5. Notifications and working at scale1 hr
   • watching
   • notification filtering
   • saved searches
   • mentions etiquette
   • inbox hygiene
6. The GitHub CLI and automation1 hr
   • gh auth
   • gh pr and gh issue
   • gh api
   • scripting workflows
   • aliases

Hands-on project: Set up a repository for a new project: templates, labels, milestones, a project board and a contributing guide.

You can open a pull request people want to review, and review someone else's without being the reason they dread it.

1. Opening a reviewable pull request1 hr
   • scope discipline
   • description quality
   • screenshots and context
   • draft PRs
   • self-review first
2. Review mechanics on GitHub1 hr
   • line comments
   • suggestions
   • review states
   • resolving threads
   • re-requesting review
3. Giving feedback well1 hr
   • severity signalling
   • asking versus telling
   • praising good work
   • nit prefix
   • knowing what to let go
4. Receiving feedback well1 hr
   • separating ego
   • clarifying questions
   • disagreeing respectfully
   • escalation
   • closing the loop
5. CODEOWNERS and required reviews1 hr
   • CODEOWNERS syntax
   • ownership design
   • required approvals
   • stale review dismissal
   • bypass auditing
6. Merge strategies and the merge queue1 hr
   • merge commit
   • squash
   • rebase merge
   • merge queue
   • strategy selection

Hands-on project: Open three pull requests of increasing complexity and review three from others, with written reflection on the feedback given and received.

You can choose a branching model that fits how your team actually releases, rather than copying one from a blog post.

1. Trunk-based development1 hr
   • short-lived branches
   • continuous integration
   • feature flags
   • release from trunk
   • prerequisites
2. GitHub flow and release branches1 hr
   • GitHub flow
   • release branch model
   • backporting
   • long-term support
   • complexity cost
3. Git flow and when it still fits1 hr
   • develop and main
   • feature branches
   • release and hotfix
   • versioned products
   • why it fell out of favour
4. Feature flags as a branching alternative1 hr
   • flag types
   • flag lifecycle
   • technical debt
   • testing both paths
   • removal discipline
5. Monorepo workflows1 hr
   • path-based CI
   • ownership
   • release coordination
   • tooling
   • scaling problems
6. Choosing and documenting a strategy1 hr
   • team shape
   • release cadence
   • regulatory constraints
   • written policy
   • review cadence

Hands-on project: Write a branching and release policy for three different team shapes and defend each choice against the alternatives.

You can build a pipeline that runs tests on every pull request and gives useful feedback in under five minutes.

1. Workflow anatomy1 hr
   • triggers
   • jobs and steps
   • runners
   • contexts
   • expressions
2. Actions, versions and the marketplace1 hr
   • using actions
   • version pinning
   • SHA pinning
   • trust evaluation
   • writing a composite action
3. Caching and build speed1 hr
   • cache action
   • cache keys
   • dependency caching
   • artefact passing
   • measuring runtime
4. Matrix builds and parallelism1 hr
   • matrix syntax
   • include and exclude
   • fail-fast
   • concurrency groups
   • cost awareness
5. Status checks and branch protection1 hr
   • required checks
   • check runs
   • annotations
   • blocking merges
   • flaky check policy
6. Debugging a failing workflow1 hr
   • log reading
   • debug logging
   • re-run with debug
   • act for local runs
   • common failures

Hands-on project: Build a CI workflow for a real project with caching, a matrix build and a required status check, finishing inside five minutes.

You can deploy from a pipeline without storing a single long-lived cloud credential.

1. Reusable and called workflows1 hr
   • workflow_call
   • inputs and secrets
   • composite actions
   • organisation templates
   • versioning
2. Secrets, variables and environments1 hr
   • repository secrets
   • environment secrets
   • required reviewers
   • deployment branches
   • secret masking
3. OIDC federation to cloud providers1.5 hrs
   • OIDC trust setup
   • role assumption
   • claim conditions
   • no static keys
   • verification
4. Supply chain security for workflows1 hr
   • SHA-pinned actions
   • permissions block
   • pull_request_target risks
   • script injection
   • dependabot for actions
5. Self-hosted runners0.5 hr
   • runner setup
   • scaling
   • isolation risk
   • public repo danger
   • maintenance
6. Release automation1 hr
   • semantic release
   • changelog generation
   • artefact publishing
   • signing
   • GitHub Releases

Hands-on project: Build a deployment workflow using OIDC federation to a cloud provider, with environment approvals and no static secrets anywhere.

You can harden a repository against the mistakes and attacks that actually happen.

1. Access control and teams1 hr
   • organisation roles
   • team permissions
   • outside collaborators
   • least privilege
   • access reviews
2. Branch and tag protection rules1 hr
   • protection rules
   • rulesets
   • signed commit requirement
   • linear history
   • admin enforcement
3. Secret scanning and push protection1 hr
   • secret scanning
   • push protection
   • custom patterns
   • remediation
   • rotation after exposure
4. Dependabot and dependency review1 hr
   • version updates
   • security updates
   • grouped updates
   • review action
   • update fatigue
5. Code scanning and security advisories1 hr
   • CodeQL
   • alert triage
   • private advisories
   • coordinated disclosure
   • security policy
6. Audit logs and incident response1 hr
   • audit log review
   • compromised token response
   • revoking access
   • forced rotation
   • post-incident review

Hands-on project: Harden a repository: branch protection, secret scanning, dependency review, signed commits and a documented access model.

You can contribute to a project you do not own and maintain one other people contribute to.

1. Finding and making a first contribution1 hr
   • good first issues
   • reading CONTRIBUTING
   • local setup
   • small first PR
   • patience with review
2. Licensing basics1 hr
   • permissive licences
   • copyleft
   • choosing a licence
   • dependency licence compatibility
   • CLA and DCO
3. Maintaining a project1 hr
   • issue triage
   • saying no kindly
   • roadmap communication
   • burnout avoidance
   • co-maintainers
4. Community health files and automation1 hr
   • templates
   • stale bots
   • welcome automation
   • labels for newcomers
   • documentation
5. Your GitHub profile as a portfolio1 hr
   • profile README
   • pinned repositories
   • contribution quality over quantity
   • what recruiters look at
   • honest presentation
6. Forks, upstreams and long-running patches1 hr
   • fork maintenance
   • rebasing on upstream
   • patch sets
   • divergence cost
   • upstreaming strategy

Hands-on project: Make a real contribution to an open-source project, and separately triage ten issues on a repository you maintain.

You can set up and run a repository to a professional standard that a team could join tomorrow.

1. Repository setup and policy1 hr
   • branching policy
   • protection rules
   • templates
   • CODEOWNERS
   • contributor guide
2. CI pipeline and quality gates2 hrs
   • test workflow
   • caching
   • matrix
   • required checks
   • runtime budget
3. Deployment workflow with OIDC1.5 hrs
   • environment setup
   • OIDC trust
   • approvals
   • deployment branches
   • rollback
4. Security hardening1.5 hrs
   • secret scanning
   • push protection
   • dependency review
   • signed commits
   • access model
5. Release process and changelog1 hr
   • semantic versioning
   • tagging
   • changelog generation
   • release notes
   • artefact publishing
6. Simulated team week and recovery drill1 hr
   • merge conflict
   • hotfix path
   • bad force push
   • reflog recovery
   • retrospective

Hands-on project: Take a project from empty repository to a working collaborative setup: branching policy, protection rules, issue and PR templates, CODEOWNERS, a CI pipeline under five minutes, a deployment workflow using OIDC with no static secrets, secret scanning and dependency review, a release with signed tags and generated changelog, and a contributor guide — then run a simulated week of team activity including a conflict, a hotfix and a bad force push to recover from.