Stop pushing commits from the wrong GitHub account

gas switches your Git identity, SSH key, and remote URL per folder — or per repo with one command. A pre-commit hook blocks email mismatches before they hit origin.

cd ~/some/repo
gas apply work          # local user.email + SSH alias + remote, all set

Install -> · Commands -> · Recipes ->

How It Works

graph LR
    A[git commit] --> B{In a configured<br/>workspace?}
    B -->|Yes| C[includeIf picks<br/>the right identity]
    B -->|No| D[gas apply id<br/>sets it locally]
    C --> E[Pre-commit hook<br/>verifies email]
    D --> E
    E -->|match| F[commit succeeds]
    E -->|mismatch| G[commit blocked]

Install

Preferred — package managers first:

pip install git-auto-switch

npm install -g git-auto-switch

Curl installer (only when no package manager fits). Download it first so you can inspect it, then run with an explicit checksum pin:

curl -fsSL https://raw.githubusercontent.com/luongnv89/git-auto-switch/main/install-curl.sh -o install-curl.sh
GAS_CHECKSUM=<sha256-of-the-release-tarball> bash install-curl.sh

Piping (curl -fsSL .../install-curl.sh | bash) still works but skips pre-run inspection — avoid it when you can.

Verification: the installer downloads the release tarball to a file and checks its SHA256 before extracting or executing anything. Precedence: explicit --checksum <sha256> / GAS_CHECKSUM first, then a <tarball-url>.sha256 sidecar (override with GAS_CHECKSUM_URL). On mismatch the download is deleted and the install aborts. With no checksum available (e.g. main snapshots publish no sidecar) it warns and continues — pin GAS_CHECKSUM for a verified install.

Every method installs the same Bash CLI, so all of them need Bash 3.2+, Git 2.13+, and jq at runtime. Each method adds its own requirement:

• pip install git-auto-switch — Python >=3.11; the wheel bundles the CLI behind a Python launcher
• npm install -g git-auto-switch — Node >=22; the package wraps the CLI via a Node launcher
• install-curl.sh — curl and tar, plus sha256sum or shasum for the verified install
• make install from a clone — make

Both launcher shims check the runtime deps on first run and offer to install missing ones via your package manager.

The PyPI and npm packages are published manually at release time. CI (.github/workflows/ci.yml) runs lint and tests on every push and PR — there is no automated release workflow yet.

See SECURITY.md for the full hardening posture, including the make security-scan secret-scan gate and state-file permissions.

Commands

Recipes

Most workflows are 1-2 commands. The recipes below cover everything most users will need.

Set up your first two accounts

gas init

Walk through the prompts: account label, workspace folder(s), SSH key path, git name, git email. The wizard validates the SSH key and tests GitHub auth before saving.

gas add

Same prompts for the second account. After this, every repo inside a configured workspace uses that account's identity automatically.

"Which account am I committing as right now?"

gas current

Output:

========================================
  Current Account: work
========================================

  Account ID:  work
  Git Name:    John Doe
  Git Email:   john@company.com
  SSH Alias:   gh-work
  Directory:   /home/user/workspace/work/project
  Workspaces:
    - ~/workspace/work
    - ~/projects/company

Returns nothing if you're outside any configured workspace.

Apply an account to a single repo

For one-off repos that sit outside any configured workspace, or to override the workspace default for one project:

cd ~/some/repo
gas apply work

Or by SSH alias — both forms work:

gas apply gh-work

What it does:

• Sets local user.name / user.email (no --global)
• Adds the SSH alias to ~/.ssh/config if it's missing
• Rewrites origin from git@github.com: -> git@gh-work:
• Switches the alias if origin was already pointing at a different one

Local config wins over includeIf, so this works inside or outside any workspace.

Find and fix wrong-identity repos

gas audit

Lists every repo whose user.email or remote alias doesn't match its workspace. Read-only — won't change anything.

gas audit --fix

Same scan, but:

• Removes local user.email overrides so includeIf can take over
• Rewrites git@github.com, ssh://git@github.com, and https://github.com remotes to use the correct SSH alias

Clone a new repo under the right account

git clone git@gh-work:org/repo.git

Use the SSH alias instead of github.com when cloning. If you forget, gas audit --fix will rewrite it next time.

Update everything after editing the config by hand

gas apply

Re-generates ~/.ssh/config, ~/.gitconfig includes, the pre-commit hook, and rewrites remotes for every workspace.

When Things Go Wrong

Comparison

License

MIT

{
  "version": "1.0.0",
  "accounts": [
    {
      "id": "work",
      "name": "Work Account",
      "ssh_alias": "gh-work",
      "ssh_key_path": "~/workspace/work/.ssh/id_ed25519",
      "workspaces": [
        "~/workspace/work",
        "~/projects/company"
      ],
      "git_name": "John Doe",
      "git_email": "john@company.com"
    }
  ]
}

cp ~/.git-auto-switch/backup/<timestamp>/ssh_config ~/.ssh/config

cp ~/.git-auto-switch/backup/<timestamp>/gitconfig ~/.gitconfig

Workspace folder [~/workspace/work]: ~/workspace/work
Add another workspace? (leave empty to continue): ~/projects/company
Add another workspace? (leave empty to continue):

[work] Work Account
  Git:    John Doe <john@company.com>
  SSH:    gh-work
  Workspaces:
    - ~/workspace/work
    - ~/projects/company
    - ~/freelance/client-a

git clone https://github.com/luongnv89/git-auto-switch.git
cd git-auto-switch
brew install jq          # or: sudo apt install jq
make install

curl -fsSL https://raw.githubusercontent.com/luongnv89/git-auto-switch/main/install-curl.sh | bash -s uninstall

brew install shellcheck bats-core jq

make lint     # ShellCheck

make test     # bats suite (226 tests)
bats test/    # same suite, direct invocation

make all      # both