# Tools to Verify Git Repository Integrity: Built-In Commands and Automation for Hiring Agent

> Verify Git repository integrity with built-in commands like git fsck and git verify pack automate checks using third-party tools for robust code security.

- Repository: [HackerRank/hiring-agent](https://github.com/interviewstreet/hiring-agent)
- Tags: how-to-guide
- Published: 2026-07-13

---

**Git provides built-in commands like `git fsck`, `git verify-pack`, and `git log --show-signature` to detect corruption and validate cryptographic signatures, while third-party tools such as `git-verify` and `git integrity` automate these checks in CI/CD pipelines.**

The `interviewstreet/hiring-agent` repository processes candidate resumes through a sensitive scoring pipeline, making repository integrity essential for security and fairness. Verifying that Git objects, commits, and tags remain untampered prevents subtle bugs and credential leaks that could compromise candidate data. This guide covers the specific tools and commands—from native Git utilities to third-party automation—that ensure the Hiring Agent codebase remains trustworthy.

## Native Git Commands for Object Integrity

Git maintains repository health through a directed acyclic graph of objects (blobs, trees, commits, and tags). The following commands traverse and validate this structure.

### Detecting Corruption with git fsck

The **`git fsck`** command performs a full integrity check of the object database. It traverses the object graph, confirms that every reachable object exists, and validates SHA-1 or SHA-256 checksums to detect bit rot or transfer errors.

Run this locally or in CI after pushes to detect corrupted packs or missing objects:

```bash

# Full repository health check

git fsck --full

# Silent check for CI scripts (fails if issues found)

if ! git fsck --quiet; then
  echo "❌ Repository integrity check failed"
  exit 1
fi

```

### Validating Packfiles with git verify-pack

Large repositories use packfiles to compress storage. The **`git verify-pack`** command reads the packfile index (`.git/objects/pack/*.idx`) and recomputes checksums for each object to ensure size consistency and data integrity.

Use this when debugging large packfiles or after running `git gc`:

```bash

# Validate all packfiles

git verify-pack -v .git/objects/pack/*.idx

```

### Finding Missing Objects

After operations like `git rebase` or `git filter-branch`, dangling references may point to deleted objects. The **`git rev-list`** command with specific flags detects these gaps:

```bash

# List objects referenced by commits but missing from storage

git rev-list --objects --no-object-names --missing --all

```

### Maintenance and Cleanup

Combine **`git gc`** with verification to clean unreachable objects and confirm the resulting state:

```bash

# Aggressive cleanup followed by verification

git gc --aggressive --prune=now
git fsck --full

```

## Cryptographic Verification for Commits and Tags

Beyond structural integrity, cryptographic signing ensures commits and releases originate from trusted sources.

### Verifying GPG Signatures in Commit History

The **`git log --show-signature`** command displays signature status (`Good signature`, `Bad signature`, or `No signature`) for each commit. This is critical for the Hiring Agent project, where [`score.py`](https://github.com/interviewstreet/hiring-agent/blob/main/score.py) orchestrates the end-to-end pipeline and must run against verified code.

```bash

# View signature status for recent commits

git log --show-signature --pretty=oneline -10

```

### Ensuring Tag Authenticity

Annotated tags should be cryptographically signed using **`git tag -s`**. Verify these signatures before deploying releases:

```bash

# Create a signed tag

git tag -s v1.0.0 -m "Release v1.0.0"

# Verify the tag signature

git verify-tag v1.0.0

```

## Third-Party Automation Tools

While native Git commands provide the foundation, third-party tools add programmatic interfaces and additional security layers.

### git-verify Python Package

The **`git-verify`** package automates multiple checks (`fsck`, signatures) and provides JSON output for CI integration. This aligns with the Hiring Agent's [`config.py`](https://github.com/interviewstreet/hiring-agent/blob/main/config.py) architecture, where the `DEVELOPMENT_MODE` flag enables caching and verification steps.

```python
import subprocess
import json

def run_git_verify() -> dict:
    result = subprocess.run(
        ["git-verify", "--json"], 
        capture_output=True, 
        text=True, 
        check=True
    )
    return json.loads(result.stdout)

if __name__ == "__main__":
    report = run_git_verify()
    if not report["ok"]:
        raise SystemExit("❌ Integrity verification failed")
    print("✅ Repository passed all checks")

```

### Secret Scanning as Integrity Indicators

Tools like **GitGuardian** and **truffleHog** scan repository history for leaked secrets, which indirectly indicates integrity breaches. These parse every object in the history, applying regex and ML patterns to detect credentials that should not exist in a clean repository.

### Long-Term Archival Verification

The **`git integrity`** Go tool audits the entire repository by computing a Merkle-tree style hash over all objects, storing it for future comparison. This is ideal for long-term archival verification of the Hiring Agent codebase.

## Implementing Checks in the Hiring Agent Workflow

The Hiring Agent repository structure supports integrity verification through specific configuration points:

- **[`config.py`](https://github.com/interviewstreet/hiring-agent/blob/main/config.py)**: Defines the `DEVELOPMENT_MODE` flag that enables extra verification steps and caching logic. Toggle this flag to activate integrity checks before running the scoring pipeline.
- **[`github.py`](https://github.com/interviewstreet/hiring-agent/blob/main/github.py)**: Contains `_create_cache_filename` and `_fetch_github_api` functions that handle external API data with rate-limit handling, illustrating how external integrity is managed alongside Git repository health.
- **[`score.py`](https://github.com/interviewstreet/hiring-agent/blob/main/score.py)**: Orchestrates the end-to-end pipeline and writes CSV outputs when `DEVELOPMENT_MODE=True`, providing a hook to run verification before processing candidate data.
- **[`requirements.txt`](https://github.com/interviewstreet/hiring-agent/blob/main/requirements.txt)**: Lists dependencies like `pymupdf`, `requests`, and `pydantic`, ensuring reproducible environments where verification tools execute consistently.

Integrate these checks into the CI pipeline to guarantee that every build runs against a verified codebase, protecting candidate data and maintaining fairness guarantees.

## Summary

- **`git fsck`** detects corrupted objects and connectivity issues by traversing the object graph and validating checksums.
- **`git verify-pack`** validates individual packfile integrity and object size consistency.
- **`git log --show-signature`** and **`git verify-tag`** confirm cryptographic authenticity of commits and releases.
- **`git rev-list --objects --missing`** spots dangling references after history rewriting operations.
- **Third-party tools** like `git-verify` (Python) and `git integrity` (Go) automate these checks for CI/CD integration.
- The Hiring Agent repository uses `DEVELOPMENT_MODE` in [`config.py`](https://github.com/interviewstreet/hiring-agent/blob/main/config.py) to enable verification workflows alongside [`github.py`](https://github.com/interviewstreet/hiring-agent/blob/main/github.py) caching functions.

## Frequently Asked Questions

### What is the difference between git fsck and git verify-pack?

**`git fsck`** checks the entire object database for connectivity and corruption across all objects, while **`git verify-pack`** specifically validates individual packfiles and their indices. Use `git fsck` for general health checks and `git verify-pack` when debugging specific packfile issues or after manual garbage collection.

### How often should I run integrity checks on a repository?

Run **`git fsck`** before major releases and after any history rewriting operations like `git rebase` or `git filter-branch`. For active projects like Hiring Agent, integrate these checks into the CI pipeline to run on every push, ensuring that the [`score.py`](https://github.com/interviewstreet/hiring-agent/blob/main/score.py) pipeline always executes against verified code.

### Can integrity verification prevent all types of repository corruption?

Git's verification tools detect accidental corruption (bit rot, transfer errors) and cryptographic tampering (via GPG signatures), but they cannot prevent malicious actors with write access from force-pushing corrupted history. Combine these tools with branch protection rules and signed commit requirements enforced in [`config.py`](https://github.com/interviewstreet/hiring-agent/blob/main/config.py) settings for comprehensive security.

### How does Hiring Agent use DEVELOPMENT_MODE to support verification?

The **`DEVELOPMENT_MODE`** flag in [`config.py`](https://github.com/interviewstreet/hiring-agent/blob/main/config.py) enables additional verification steps and caching mechanisms via [`github.py`](https://github.com/interviewstreet/hiring-agent/blob/main/github.py) functions like `_create_cache_filename`. When enabled, the system can run integrity checks before executing the [`score.py`](https://github.com/interviewstreet/hiring-agent/blob/main/score.py) pipeline, ensuring that development and testing environments maintain the same verification standards as production.