Page 2 of 2
Manual version bumping and changelog writing doesn't survive contact with a team shipping frequently - it's tedious, inconsistent, and someone eventually forgets a step under deadline pressure. The fix is making the commit history itself the source of truth for releases.
Conventional commits (feat:, fix:, feat!: or BREAKING CHANGE: in the body) give tooling like semantic-release or release-please enough structure to compute the next semantic version automatically, generate a changelog from commit messages, and cut a signed, tagged release with zero manual version decisions.
git log --oneline v1.4.0..HEAD | grep '^[a-f0-9]* feat' # what's driving the next minor bump
The judgment call is where to enforce the convention: purely by human discipline (fragile, degrades under pressure), by a commit-msg hook (bypassable locally with --no-verify), or by a CI check that blocks merge on malformed commit messages (the only one that reliably holds at scale, because it can't be skipped by an individual in a hurry).
Past a certain size, generic Git hosting features stop covering an organization's actual policy needs, and platform teams start building on top of Git rather than just using it - policy bots that comment on or block PRs missing a linked ticket, custom pre-receive hooks-as-a-service that scan every incoming push for secrets before it's even accepted, dashboards tracking merge-to-deploy latency across hundreds of repos.
The key design principle: prefer server-side enforcement (a pre-receive hook, a required CI check, a branch-protection API call) over asking every engineer to install something locally. Client-side tooling can always be skipped, misconfigured, or simply never installed by a new hire - server-side enforcement is the only kind that's actually guaranteed, and it's the same principle from hooks at the hard tier, just applied at the scale of "every repo in the company" instead of one team's repo.
The reflog (hard tier) is a personal, local safety net with an expiration date - it's not a backup strategy for an organization's entire Git history. Real org-level disaster recovery means the hosting platform's own backups (most managed Git hosts run continuous or near-continuous backups, but "we use GitHub" is not itself a documented recovery plan) and, for anything genuinely critical, an independent mirror.
git clone --mirror https://github.com/org/critical-repo.git # full mirror: all refs, all history
A --mirror clone captures every branch, tag, and ref exactly - a real backup, unlike a normal clone which only gets branches you explicitly track. The organizational judgment call is defining actual RPO/RTO for source code loss (how much history could you tolerate losing, how fast do you need to be back operating) and testing restoration before you need it - a backup nobody has ever restored from is a hypothesis, not a plan.
In regulated industries (finance, healthcare, defense), "who changed this code and can we prove it" isn't a nice-to-have, it's an audit requirement, and it changes which Git features move from optional to mandatory.
Signed commits (hard tier) become non-negotiable rather than a security nicety - enforced via required branch protection, with an org-wide policy on which keys are trusted and how they're rotated when someone leaves. Immutable audit trails mean force-pushes to protected branches must be disabled outright, not just discouraged, since a force-push can rewrite the very history an auditor needs to trust. Some environments require every commit traceable to an approved change ticket, enforced by a commit-msg hook validated server-side, tying the SDLC's change-management process directly into Git rather than treating them as separate systems that happen to agree.
The broader principle underneath all of this: compliance requirements turn "best practice" Git hygiene - signing, protected branches, no force-push, clean audit trails - into hard technical enforcement, because in a regulated context "we asked people nicely" is not an acceptable control.
Real scenario-based DevOps questions, hands-on practice, and clear explanations for every answer.