Newgit

Create a .gitignore skeleton, optionally initialize a git repository, and install a secret-scanning pre-commit hook.

No external dependencies, all self-contained, all Python. You're not you without version control, eat a Newgit

Quick usage

If you have the Python script:

./newgit.py [path]

If you have the compiled binary:

./newgit [path]

If path is omitted, it uses the current directory.

Examples

Create .gitignore in the current directory and prompt for git init:

./newgit.py

Create .gitignore in a new project directory:

./newgit.py ~/projects/my-app

Override the ignore patterns for a single run. Put the path before -i if you also pass a directory:

./newgit.py -i .venv/ node_modules/ __pycache__/
./newgit.py ~/projects/my-app -i .venv/ node_modules/

Skip the git init prompt and always run it:

./newgit.py --git-init

Skip the git init prompt and never run it:

./newgit.py --no-git-init

Force the built-in defaults even if a config file exists:

./newgit.py --defaults

Skip the pre-commit hook installation when running git init:

./newgit.py --git-init --no-precommit

Create an AGENTS.md skeleton that instructs coding agents never to run ANY git commands (including read-only ones like git status, and indirect use via scripts or subagents):

./newgit.py ~/projects/my-app --agent-md --no-git-init

If AGENTS.md already exists, it is left untouched. See also the agent_md / no_agent_md config keys below.

Default ignore patterns

The generated .gitignore includes common build, IDE, and macOS artifacts, plus secret- and credential-related files:

# Editor / IDE
.cursor/

# Agent skills
/SKILL.md

# Build / debug artifacts
.build/
.debug/

# macOS
.DS_Store

# Secrets and credentials
.env
.env.*
!.env.example
*.pem
*.key
*.p12
*.pfx
*.keystore
*.jks
id_rsa
id_rsa.pub
id_dsa
id_dsa.pub
id_ecdsa
id_ecdsa.pub
id_ed25519
id_ed25519.pub
secrets/
credentials/
private/

Configuration

You can provide a persistent list of ignore patterns in a config file:

• $XDG_CONFIG_HOME/newgit/ignore
• ~/.config/newgit/ignore (fallback)

The file uses one pattern per line. Lines starting with # and blank lines are ignored. If the file exists, it replaces the built-in defaults. Use --defaults to ignore the config file.

newgit.yml

All optional flags can also be configured via a newgit.yml file. newgit looks for it first in the target directory, then in the global config directory ($XDG_CONFIG_HOME/newgit/newgit.yml or ~/.config/newgit/newgit.yml).

Supported keys (all optional):

Key	Type	Description
path	string	Target directory (default: .)
ignore	list	Ignore patterns to write
defaults	boolean	Use built-in defaults instead of config file
no_precommit	boolean	Do not install the secret-scanning pre-commit hook
git_init	boolean	Run git init without prompting
no_git_init	boolean	Do not run git init
agent_md	boolean	Create an AGENTS.md skeleton forbidding any git commands (default: false)
no_agent_md	boolean	Do not create AGENTS.md

Example newgit.yml:

path: .
ignore:
  - .venv/
  - node_modules/
  - __pycache__/
  - .DS_Store
git_init: true
no_precommit: false

CLI arguments override newgit.yml values. --defaults still forces the built-in ignore patterns regardless of the config file. git_init and no_git_init cannot both be set to true, and agent_md and no_agent_md cannot both be set to true.

The inline parser supports a small YAML subset: top-level keys, block lists, quoted strings, booleans, numbers, and null. Flow lists (e.g. ignore: [a, b]) and block scalars (|, >) are parsed only on a best-effort basis.

Existing .gitignore behavior

If the target directory already contains a .gitignore, the tool prompts:

.gitignore already exists. [o]verwrite / [a]ppend / [q]uit:

Append mode merges the resolved patterns into the existing file, skipping duplicates.

Secret-scanning pre-commit hook

When git init is run (or when you run newgit inside an existing repository), it offers to install a pre-commit hook in .git/hooks/pre-commit. The hook scans staged files for:

• Private key blocks (-----BEGIN ... PRIVATE KEY-----)
• AWS access key IDs (AKIA...)
• Lines containing api_key, secret_key, private_key, auth_token, or access_token followed by a value
• Provider-specific key formats for OpenAI, Anthropic, Cursor, DeepSeek, Kimi/Moonshot, and Z.ai (including sk-..., key_..., and Z.ai id.secret keys)
• Sensitive filenames such as .env, .pem, .key, .p12, .pfx, .keystore, and .jks

If it finds any of these, the commit is blocked and the offending lines are printed. The hook is written in Python and requires python3 to be available in the environment where commits are made.

Building a standalone binary

You can build a single-file executable for Linux or macOS with PyInstaller.

Install PyInstaller (once):

pip install pyinstaller

Build the binary:

make

The resulting executable is written to dist/newgit. You can run it directly or copy it to a directory on your PATH:

./dist/newgit --help
cp dist/newgit /usr/local/bin/newgit

To clean build artifacts:

make clean

Notes:

• PyInstaller binaries are platform-specific. Run make on each platform where you need a binary (e.g., macOS for macOS, Linux for Linux).
• make install copies dist/newgit to /usr/local/bin/newgit.