Building a Secure Git Automation Tool Using Python and Cron

Most developers are familiar with Git automation scripts that automatically commit and push changes. While automation can save time, unsafe automation can easily create bigger problems — such as accidentally committing sensitive files or pushing unintended changes without visibility.

I wanted to explore whether Git automation could be done responsibly, with security and control in mind, rather than blindly automating everything. This blog documents how I built a secure Git automation tool using Python and cron, what problems it solves, and what I learned along the way.

Why I Built This Project

While working regularly on Linux-based projects, I noticed that:

• Manually committing small changes repeatedly becomes tedious
• Forgetting to commit breaks consistency
• Automating Git without safeguards is risky
• Sensitive files can easily slip into commits

Instead of building a fully unattended automation, my goal was to design a tool that balances convenience with safety.

The focus was not on committing faster, but on committing safely.

High-Level Idea of the Tool

The tool automatically checks a specific project directory and:

• Detects file changes using Git
• Skips potentially sensitive files
• Commits only a limited number of files per run
• Supports a dry-run mode for safe testing
• Logs every action for visibility
• Runs automatically using cron

This approach ensures that automation never becomes invisible or dangerous.

How the Automation Works

At a high level, the workflow looks like this:

1. The script reads configuration values from a JSON file
2. It checks the Git repository status using:

git status --porcelain

3.Each detected file is analyzed before committing

4.Sensitive files are skipped automatically

5.Only a fixed number of safe changes are processed per run

6.Commits are created and pushed using SSH authentication

7.All actions are logged with timestamps

Get Asad Sayyad’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This design keeps the automation predictable and easy to debug.

Image of a GitHub log.

Key Features

Controlled Git Automation

Instead of committing everything at once, the script commits only a configurable number of files per execution. This keeps commit history clean and meaningful.

Sensitive File Protection

Files containing keywords such as password, token, secret, or sensitive extensions like .env and .pem are skipped automatically. This reduces the risk of accidental data exposure.

Dry-Run Mode

A dry-run mode allows previewing all actions without executing any Git commands:

python3 gith_auto_commit.py --dry-run

This is especially useful before enabling cron-based automation.

Cron-Based Scheduling

The script integrates with Linux cron jobs, allowing scheduled execution without manual intervention.

Secure Authentication

GitHub interactions use SSH authentication instead of passwords or tokens, aligning with secure development practices.

Structured Logging

Every action — commits, skips, warnings, and errors — is logged. This makes the automation transparent and easy to audit.

Security Considerations

Security was a key design concern throughout this project.

• Automation skips sensitive files instead of blocking execution completely
• Dry-run mode prevents accidental changes during testing
• SSH authentication avoids hardcoded credentials
• Logging ensures that automation never operates silently

The goal was to reduce risk without sacrificing usability.

Challenges I Faced

GitHub Push Protection

During development, GitHub blocked pushes after detecting sensitive content in the repository history. This highlighted the importance of GitHub’s secret scanning and reinforced the need for preventive checks in automation scripts.

SSH Authentication Issues

Automated Git pushes initially failed due to password-based authentication being deprecated. Switching to SSH resolved the issue and made the automation non-interactive and secure.

Cron Debugging

Cron jobs don’t provide immediate output, making debugging difficult. Implementing structured logging solved this by providing clear runtime visibility.

Sensitive File Edge Cases

Early versions of the script blocked execution entirely when encountering sensitive files. The logic was later improved to skip such files and continue processing safe ones.

Testing and Validation

The tool was tested under multiple scenarios:

• Creating, modifying, and deleting files
• Testing various sensitive filename patterns
• Verifying commit limits per execution
• Running the script in dry-run mode
• Executing the script via cron

Each test confirmed that the tool behaves predictably and safely.

Result for successfully working scripts on bandit directory

Limitations

• Sensitive file detection is filename-based, not content-based
• Designed primarily for single-user repositories
• No cryptographic integrity monitoring
• Relies on cron environment configuration

These limitations were accepted intentionally to keep the project focused and manageable.

What I Learned

This project helped me gain practical experience with:

• Secure automation design
• Git internals and secret scanning
• SSH-based authentication
• Cron job scheduling and debugging
• Logging and visibility in automation tools

More importantly, it taught me that automation without control is risky, especially in security-sensitive environments.

Conclusion

This project demonstrates that Git automation does not need to be aggressive or unsafe to be useful. By introducing limits, visibility, and security checks, it is possible to automate routine tasks while maintaining control and accountability.

Building this tool reinforced the importance of thoughtful design when working with automation — especially in environments where security matters.

GitHub Repo of this project.

📌 You can find the automation scripts and setup on GitHub here.