Gate reference
l0-git ships 36 built-in gates. Every one of them fires only when the violation can be stated as a binary condition over the file system, the git index, or a parse tree, so a finding is reproducible on any machine, and two runs over the same tree always agree.
Three gates are opt-in and do nothing until you enable them in .l0git.json: Secrets scan (history), Large blob in history and Branch protection declared.
sh
lgit gates # the same list, straight from the binaryA directory that is not a git repository
Many of the gates read the git index. On a directory with no .git/, lgit check does not repeat that once per gate: it files one info finding under the id git_repository, "Not a git repository, 17 gates skipped", that names the gates it stopped. git_repository is not a gate of its own and is not in lgit gates; it retires itself the next time the directory is a repository, and "ignore": ["git_repository"] in .l0git.json silences it. Asking for a single gate (lgit check . secrets_scan) still answers with that gate's own notice.
Project hygiene
| Gate | Severity | What it catches |
|---|---|---|
| README present | Warning | A repository with no README is a repository nobody can adopt. |
| LICENSE present | Warning | Without a license file, default copyright applies and nobody may legally reuse the code: however open the repository looks. |
| CONTRIBUTING present | Info | Tells an outside contributor how to build, test and submit a change before they burn an afternoon guessing. |
| SECURITY policy present | Info | A SECURITY.md is the difference between a researcher mailing you privately and a researcher opening a public issue with a working exploit. |
| CHANGELOG present | Info | One place users can look to see what changed between releases, instead of reading the commit log. |
| CODE_OF_CONDUCT present | Info | States the rules of engagement before you need them, not during the incident. |
| Pull request template present | Info | Standardises what a PR description contains, so reviewers stop asking the same three questions. |
| Issue templates present | Info | Turns "it doesn't work" into a report you can actually act on. |
| CI workflow present | Warning | If nothing runs the tests on push, the tests are decoration. |
Governance
| Gate | Severity | What it catches |
|---|---|---|
| CODEOWNERS present | Info | Routes pull requests to the people who actually own the touched paths. |
| Branch protection declared | Info | Checks that branch protection is declared as code. |
Git hygiene
| Gate | Severity | What it catches |
|---|---|---|
| .gitignore present | Warning | The first line of defence against committing build artefacts and secrets by accident. |
| .gitignore coverage | Warning | Having a .gitignore is not the same as having the right one. |
| Tracked file matches .gitignore | Warning | Your .gitignore says a file should not be in the repository, and the index says it is. |
| Merge conflict markers | Error | An unresolved conflict marker on a shipping branch is never intentional. |
| Large file tracked | Warning | Large binaries in git are permanent: every clone pays for them forever, even after you delete them. |
| Vendored directory tracked | Warning | Dependency directories are meant to be rebuilt from a manifest. |
| Editor/IDE artefact tracked | Warning | User-local editor state does not belong in shared history. |
| Unexpected executable bit | Warning | A README.md tracked as mode 100755 is a mistake that survives every clone and confuses every packaging script. |
| File name quality | Info | Filenames containing spaces or invisible characters break every shell pipeline that forgot to quote $f. |
Security
| Gate | Severity | What it catches |
|---|---|---|
| Secrets scan | Error | Scans tracked files for credential shapes that are unambiguous enough to act on. |
| Connection strings | Info | Finds connection URIs in tracked source: legacy plaintext protocols, database URIs, and anything carrying inline credentials. |
| Network scan | Info | Surfaces hardcoded IPv4 literals, CIDR blocks and ASN references. |
Git history (opt-in)
| Gate | Severity | What it catches |
|---|---|---|
| Secrets scan (history) | Warning | Deleting a secret from the working tree does not delete it from .git. This gate reads what is still in there. |
| Large blob in history | Warning | Finds the files that are still making your clone slow long after you deleted them. |
Containers
| Gate | Severity | What it catches |
|---|---|---|
| Dockerfile lint | Warning | An AST-based lint over tracked Dockerfiles: reproducibility and least privilege, nothing stylistic. |
| Compose lint | Warning | A YAML-AST lint over tracked Compose files, aimed at the settings that hand a container the host. |
Frontend & accessibility
| Gate | Severity | What it catches |
|---|---|---|
| HTML lint | Warning | Accessibility violations in tracked HTML that can be decided from the parse tree alone: no rendering, no heuristics. |
| CSS lint | Warning | Three things that are wrong in any stylesheet, regardless of taste. |
Documentation
| Gate | Severity | What it catches |
|---|---|---|
| Markdown lint | Warning | AST lint over tracked Markdown, via goldmark. |
| Dead placeholders | Info | Finds the unfinished-work markers that were meant to be temporary. |
| Uncommented .env.example key | Info | A list of bare KEY= lines tells a new contributor nothing about what to put in them. |
Quality & release
| Gate | Severity | What it catches |
|---|---|---|
| Tests present | Warning | Detects whether the project has any tests at all. |
| Config parse error | Warning | A package.json or CI workflow that does not parse is a defect you can prove without running anything. |
| Version drift | Warning | When two manifests in the same repository claim different versions, at least one of them is lying to whoever reads it. |
| Missing .nvmrc / .node-version | Info | A package.json with no pinned Node version means nvm, asdf, Volta and your CI runner each pick whatever Node they happen to have. |