Before deploymentgit-repository-readiness

Git Repository Production Readiness Checklist

17 items ·9 critical ·7 warn ·1 info

How to use this checklist

This is the gate before a repository is allowed to carry anything that runs in production — pipelines, plans, manifests, secrets references. It is deliberately blunt: a repo without protection, ownership, and a clean history is not a production repo, regardless of how clean its working tree looks at HEAD.

Work through it during the initial onboarding of a repository and again on a quarterly cadence afterwards, because every one of these items decays: people leave, bypass lists grow, dependencies rot. A repo that passed this list last quarter and has had no reviews since should be treated as failing it now.

Sign-off

Every critical item must pass. A failing critical item blocks the repository from being used by a production pipeline; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical9 items

The repository has a single stated purpose (Terraform, Ansible, Kubernetes, GitOps, container, or policy) and no unrelated content is checked in alongside it.
A single default branch exists (`main` or `master`). Releases are cut from tags, not from long-lived branches, and the default branch name is enforced by a repository rule.
No Terraform `*.tfstate`, `*.tfstate.backup`, Kubernetes `Secret` literal data, or compiled binaries are committed. `.gitignore` and the repository itself are both verified with `git ls-files | grep -E "\.tfstate($|\.)"` returning nothing.
```
git ls-files | grep -E "\.tfstate($|\.)|secrets\.yaml|id_rsa|\.pem$|\.key$" || echo "no plaintext secret-shaped files tracked"
```
The default branch is protected: direct pushes are blocked, force-pushes are blocked, the branch cannot be deleted, and required status checks gate merges.
At least one CI check is required to pass before merge on the default branch, and that check has a name that is enforced rather than advisory.
A `CODEOWNERS` file exists at the repository root, covers every top-level directory, and each path entry resolves to at least one valid team or user — not a placeholder.
No deploy keys, PATs, or service-account credentials are committed in any branch, tag, or PR comment history. A secret scanner has been run against the full git history, not just HEAD.
```
gitleaks detect --source . --no-banner --redact
```
The repository has a named owner team, and the access list (admins, write, maintain, triage) has been reviewed within the last 90 days; former employees and stale bots are removed.
Two-factor authentication is required at the organisation or repository level for everyone with write or admin access.

Warning7 items

The directory layout matches the stated purpose: Terraform uses `modules/`, `envs/`, `live/`; Kubernetes uses `apps/`, `base/`, `overlays/`; GitOps uses `clusters/<env>/` or equivalent. The layout is documented in a top-level `README.md`.
Files that cannot live in normal git (binaries > 500 KB, archives, images, .ova, .iso, .vhd) are routed through Git LFS with a `.gitattributes` that pins them, not just left in-tree hoping for the best.
```
git lfs ls-files | wc -l
```
Commit signature verification is enabled at the repository level, and unsigned or unverified commits on the default branch are reviewed before merge.
Release tags are signed (GPG or SSH), and the verification setting on the repo rejects tags whose signature cannot be verified against the trusted signer list.
Forking is disabled when not needed, or the consequences of forks (they survive deletions, they receive copies of secrets in fork-visible data) are documented and accepted.
The repository is mirrored or backed up to a second location outside the primary git host, so that a host outage does not lose history, branches, and tags.
No file in history exceeds 100 MB. Anything larger has been either removed via `git filter-repo` or migrated to LFS, and a `git count-objects -vH` reports a reasonable pack size.
```
git rev-list --objects --all | git cat-file --batch-check="'%(objecttype) %(objectname) %(objectsize) %(rest)'" | awk '/^blob/ {print $3" "$4}' | sort -nr | head -20
```

Info1 item

A procedure exists to archive or transfer the repository if the team owning it disbands, and the destination (another team, an archive org) is recorded.