I don't like the advice he gives on just denying access to .git. I think the idea of cloning the repo in the htdocs folder is just wrong.
A much better approach (or at least, what I use) would be to set up the repo somewhere private with --bare and set a receive hook to checkout HEAD to the htdocs folder, this way the htdocs only has the content and you get the extra feature that you can sneak extra commands on the checked out source (such as building/minifying) without changing the original source
It's actually kind of mentioned at the end of the article:
> Another approach is to use git’s --git-dir and --work-tree switches to move the git repository out of the document root.
Yet another option is to make the htdocs directory a worktree of the git repository, which doesn't require passing flags around, or setting environment variables. Technically, this still leaves a .git, but it's only a file containing the actual location to the real .git directory.
This sounds like an awesome approach. Do you have any resources you could share on a few of the details? Using --bare I get, but I've not yet played with hooks and such.
Git hooks are just arbitrary scripts. They need to exist in a specific location, and accept certain arguments depending on when in the lifecycle they are meant to execute. But they can be written to do basically anything. From linting and syntax checking, to complex deploy behaviors.
A much better approach (or at least, what I use) would be to set up the repo somewhere private with --bare and set a receive hook to checkout HEAD to the htdocs folder, this way the htdocs only has the content and you get the extra feature that you can sneak extra commands on the checked out source (such as building/minifying) without changing the original source