Push, pull, fetch and clone

Two copies of the repo

A commit is a save point for code, and a repo (repository) is the project plus all its commits. Kai's repo lives on Kai's laptop. That is the local repo.

To share work and keep it safe, the team also keeps a remote repo: a copy on a server. Ours are private repos on GitHub, so only invited people can see them.

Git doesn't sync by itself. You decide when to send and receive commits, using four commands.

Clone: your first copy

When you join a project, you don't copy files by hand. You clone it:

git clone https://github.com/our-studio/garden-defense.git

This makes a garden-defense folder with every file and the whole history. Git also remembers where the copy came from, under the nickname origin. git remote -v shows that address.

You clone once per computer. After that, you push and pull.

Push: send your commits

Push uploads your new commits to the remote. The first time you push a branch, type:

git push -u origin main

That means: push my main branch to origin. -u is short for "set upstream": remember this link. After that, plain git push is enough.

Push only sends commits. Changes you haven't committed stay on your laptop.

Fetch vs pull

Two commands bring in teammates' work:

• git fetchDownloads new commits from origin so you can look at them. Your files don't change. Safe to run any time.
• git pullFetch plus merge: downloads new commits and mixes them into your branch, so your files change.

Bolt says: Start each work session with git pull, so you build on the newest version.

Ahead and behind

After a fetch, git status compares your branch with origin's copy, called origin/main:

Your branch is behind 'origin/main' by 2 commits means teammates pushed 2 commits you don't have. Pull them.

Your branch is ahead of 'origin/main' by 1 commit means you have 1 commit nobody else has. Push it.

It can be both at once, called diverged. Then you pull first, combine the work, and push.

.gitignore and secrets

Some files must never be pushed. A file called .gitignore lists them, one per line:

node_modules/
.env

node_modules holds thousands of downloaded library files that npm can rebuild any time. .env holds secrets: passwords and keys, like a Stripe secret key, which starts with sk_. If a secret is ever pushed, deleting it later isn't enough, because old commits still contain it. Treat it as leaked and replace the key.

Proving it's you

Only our team may push to our private repos, so Git must prove who you are. GitHub stopped accepting account passwords for Git in 2021. Instead you use one of these, often set up by a browser sign-in window:

• A token: a long, random password made just for Git, which you can cancel any time.
• An SSH key: a matching pair. The public key goes on GitHub, like a lock. The private key stays on your laptop, like the only key that opens it. Never share it.

Bolt says: Next lesson: branches, so Kai and Remy can work at the same time without bumping into each other.