Agent skill

Git Investigation

This skill should be used when the user asks to "use git blame", "check git history", "find git commits", "use git log", "use git diff", "use git bisect", "trace code changes", "find who changed this code", or mentions using git commands for investigating code history and changes during root cause analysis.

View SKILL.md on GitHub Repository
Stars 163
Forks 31

Install this agent skill to your Project

npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/development/git-investigation-evangelosmeklis-thufir

SKILL.md

Git Investigation

Overview

Git is a distributed version control system that tracks code changes over time. This skill provides guidance for using git commands to investigate code history, identify when bugs were introduced, and track down specific changes during root cause analysis.

When to Use This Skill

Apply this skill when:

  • Tracing when specific code was changed
  • Finding who authored problematic code
  • Identifying commits that introduced bugs
  • Comparing code versions before/after incidents
  • Searching commit messages for clues
  • Binary searching for breaking commits (bisect)

Essential Git Commands for RCA

git log - View Commit History

Basic usage:

bash
git log

Useful flags for RCA:

Show commits with diffs:

bash
git log -p

Show commits for specific file:

bash
git log -- path/to/file.js

Show commits in time range:

bash
git log --since="2025-12-19 00:00" --until="2025-12-19 23:59"

Show one-line summaries:

bash
git log --oneline

Show commits by author:

bash
git log --author="Developer Name"

Show commit graph:

bash
git log --graph --oneline --all

Search commit messages:

bash
git log --grep="database" --grep="pool" --all-match

Format output:

bash
git log --format="%h %an %ad %s" --date=short

git blame - Find Line Authors

Basic usage:

bash
git blame path/to/file.js

Show line ranges:

bash
git blame -L 40,50 path/to/file.js

Show email addresses:

bash
git blame -e path/to/file.js

Follow line history through renames:

bash
git blame -C -C -C path/to/file.js

Show commit details:

bash
git blame -s path/to/file.js

Blame output format:

abc123de (Developer Name 2025-12-19 10:15:00 +0000 45)   max: 10,
  • abc123de: Commit SHA
  • Developer Name: Author
  • 2025-12-19 10:15:00: Timestamp
  • 45: Line number
  • max: 10,: Code content

git diff - Compare Versions

Compare working directory with last commit:

bash
git diff

Compare specific commits:

bash
git diff commit1 commit2

Compare file across commits:

bash
git diff commit1 commit2 -- path/to/file.js

Compare with previous commit:

bash
git diff HEAD~1 HEAD

Show diff for specific commit:

bash
git show commit_sha

Unified diff with context:

bash
git diff -U5  # Show 5 lines of context

Word-level diff:

bash
git diff --word-diff

git show - View Commit Details

Show complete commit:

bash
git show commit_sha

Show specific file in commit:

bash
git show commit_sha:path/to/file.js

Show commit metadata only:

bash
git show --stat commit_sha

git bisect - Binary Search for Breaking Commit

Use when: You know code worked at one point and is broken now, but don't know which commit broke it.

Workflow:

  1. Start bisect:
bash
git bisect start
  1. Mark current as bad:
bash
git bisect bad
  1. Mark known good commit:
bash
git bisect good commit_sha  # or tag, or HEAD~20

  1. Test current code (git checks out midpoint)

    • Run tests or reproduce bug
    • If broken: git bisect bad
    • If working: git bisect good

  2. Repeat until git identifies first bad commit

  3. End bisect:

bash
git bisect reset

Automated bisect:

bash
git bisect start HEAD v1.0
git bisect run ./test-script.sh

Test script should exit 0 for good, non-zero for bad.

Git Investigation Workflows

Workflow 1: Find When Line Changed

Goal: Identify when specific line was last modified

Steps:

  1. Use blame to find commit:
bash
git blame path/to/file.js | grep "suspicious code"

  1. Extract commit SHA from blame output

  2. View commit details:

bash
git show commit_sha
  1. Review commit message, author, timestamp, and changes

Workflow 2: Track File History

Goal: See all changes to a file over time

Steps:

  1. View commit history for file:
bash
git log -p -- path/to/file.js
  1. Focus on time range around incident:
bash
git log --since="2025-12-18" --until="2025-12-19" -- path/to/file.js
  1. Review each commit's diff to identify suspicious changes

Workflow 3: Find Recent Changes to Multiple Files

Goal: Identify recent commits affecting several related files

Steps:

  1. List recent commits with file stats:
bash
git log --since="2025-12-19" --stat
  1. Filter commits touching specific directory:
bash
git log --since="2025-12-19" -- src/config/
  1. Look for commits near incident time that modified relevant files

Workflow 4: Search Commit Messages

Goal: Find commits related to specific feature or bug

Steps:

  1. Search commit messages:
bash
git log --grep="database" --grep="connection" --all-match
  1. Or search for any of multiple terms:
bash
git log --grep="database\|connection\|pool"
  1. Review matching commits for relevance

Workflow 5: Compare Working vs Deployed Version

Goal: Identify differences between deployed and current code

Steps:

  1. Find deployed commit SHA (from deployment logs or tags):
bash
deployed_sha="abc123"
  1. Compare with current code:
bash
git diff $deployed_sha HEAD
  1. Or compare specific file:
bash
git diff $deployed_sha HEAD -- path/to/file.js
  1. Review differences for potential issues

Workflow 6: Binary Search for Breaking Commit

Goal: Find exact commit that introduced bug

Steps:

  1. Identify known-good commit (e.g., last working version):
bash
git log --oneline
# Find commit SHA before issue appeared
  1. Start bisect:
bash
git bisect start
git bisect bad  # Current is broken
git bisect good good_commit_sha

  1. Test each checkout:

    • Reproduce issue or run tests
    • Mark as git bisect good or git bisect bad

  2. Git identifies first bad commit

  3. Review that commit to find root cause

Advanced Git Techniques

Finding Deleted Code

Search for deleted lines:

bash
git log -S "deleted code pattern" --all

Example - Find when "max: 100" was removed:

bash
git log -S "max: 100" -- src/config/database.js

Following Renames

Track file across renames:

bash
git log --follow -- path/to/file.js

Blame with rename detection:

bash
git blame -C -C -C path/to/file.js

Finding Large Changes

Show commits by diff size:

bash
git log --stat --format="%h %s" | head -20

Find commits with many changes:

bash
git log --shortstat | grep -E "file.*change"

Checking Specific Commit

View commit details:

bash
git show commit_sha

View files changed in commit:

bash
git show --name-only commit_sha

View commit as patch:

bash
git format-patch -1 commit_sha

Interpreting Git Output

Git Blame Output

abc123de src/config/database.js (Developer Name 2025-12-19 10:15:00 +0000 45)   max: 10,

Extract:

  • Commit: abc123de
  • File: src/config/database.js
  • Author: Developer Name
  • Date: 2025-12-19 10:15:00
  • Line: 45
  • Code: max: 10,

Action: Check if timestamp correlates with incident start.

Git Log Output

commit abc123def456789
Author: Developer Name <dev@example.com>
Date:   Thu Dec 19 10:15:00 2025 +0000

    Refactor database configuration

    Align pool size with staging environment

Extract:

  • Full SHA: abc123def456789
  • Author: Developer Name <dev@example.com>
  • Date: Thu Dec 19 10:15:00 2025
  • Message: Multi-line commit message

Red flags:

  • Vague messages: "fix bug", "update code"
  • Large refactors near incident time
  • Config changes without explanation

Git Diff Output

diff
diff --git a/src/config/database.js b/src/config/database.js
index abc123d..def456e 100644
--- a/src/config/database.js
+++ b/src/config/database.js
@@ -42,7 +42,7 @@ function createConnectionPool() {
   return new Pool({
     host: process.env.DB_HOST,
     port: process.env.DB_PORT,
-    max: 100,
+    max: 10,  // Align with staging
     min: 10,
     idleTimeoutMillis: 30000
   });

Interpret:

  • - line: Old code (removed)
  • + line: New code (added)
  • @@ -42,7 +42,7 @@: Line numbers (start at line 42, 7 lines shown)

Identify issue: max: 100 → max: 10 is likely problematic reduction.

Best Practices

Do:

  • Use time ranges to focus on relevant commits
bash
git log --since="2025-12-19 00:00" --until="2025-12-19 23:59"
  • Filter by file/directory to reduce noise
bash
git log -- src/config/
  • Combine flags for precise queries
bash
git log --author="Developer" --since="1 week ago" -- src/
  • Use grep to search commit messages
bash
git log --grep="database"
  • Follow renames when tracking file history
bash
git log --follow -- file.js
  • Use bisect for efficient debugging
bash
git bisect start HEAD v1.0.0

Don't:

  • Run git log without filters (too much output)
  • Ignore commit messages (valuable clues)
  • Forget time context (correlate with incident time)
  • Skip reading full diffs (may miss subtle bugs)
  • Blame individuals (focus on system improvements)

Integration with Thufir

This skill integrates with:

  • root-cause-analysis skill: Git provides evidence for RCA
  • platform-integration skill: Complements GitHub/GitLab API data
  • RCA agent: Agent uses git commands via Bash tool

Using Git in RCA Agent

Agent can execute git commands:

bash
# Find recent commits to file
git log --since="24 hours ago" --oneline -- src/config/database.js

# Blame specific line
git blame -L 45,45 src/config/database.js

# Show commit details
git show abc123

# Compare versions
git diff HEAD~1 HEAD -- src/config/database.js

Agent parses output to extract commit SHAs, authors, timestamps, and changes.

Common Patterns

Pattern 1: Stack Trace Points to File

  1. Extract file and line from stack trace
  2. Use git blame on that file/line
  3. Identify commit that last touched it
  4. Use git show to review commit
  5. Correlate commit time with incident

Pattern 2: Config Change Suspected

  1. List recent commits to config files:
bash
git log --since="1 week ago" -- config/ src/config/
  1. Review each commit's diff:
bash
git show commit_sha
  1. Identify config value changes
  2. Correlate changes with incident symptoms

Pattern 3: Recent Deployment Broke Code

  1. Find deployed commit (from deployment logs)
  2. Compare with previous deployment:
bash
git diff previous_commit deployed_commit
  1. Review all changes in that diff
  2. Identify suspicious changes
  3. Test hypothesis by reverting specific changes

Pattern 4: Bug Introduced Sometime Ago

  1. Identify known-good version
  2. Use git bisect:
bash
git bisect start HEAD good_commit
git bisect run ./test-reproduction.sh
  1. Git identifies first bad commit
  2. Review that commit for root cause

Additional Resources

Reference Files

For advanced git techniques:

  • references/git-aliases.md - Useful git aliases for RCA
  • references/git-workflows.md - Complete RCA investigation workflows

Example Files

Working examples:

  • examples/bisect-script.sh - Sample automated bisect script

Quick Reference

Recent commits: git log --since="1 day ago" --oneline Blame line: git blame -L 45,45 file.js Show commit: git show abc123 Diff commits: git diff commit1 commit2 Search messages: git log --grep="pattern" File history: git log -p -- file.js Binary search: git bisect start HEAD good_commit

Correlate timestamps: Always compare git timestamps with incident timeline Follow renames: Use --follow flag for moved files Read full diffs: Don't just trust commit messages

Master git investigation techniques to efficiently trace code history and identify exact commits that introduced production issues.

Didn't find tool you were looking for?

Be as detailed as possible for better results