CI/CD で IaC を運用するインフラエンジニアのための Git コマンド集

main を最新にする → future- / fix- ブランチを作る → IaC を修正
  → status/diff で確認 → add → commit → push → PR
  → (CI で plan を確認) → main にマージ → CI が apply
  → ローカルの main を pull して終わり

git switch main

Switched to branch 'main'
Your branch is up to date with 'origin/main'.

git pull

Already up to date.

git switch -c future-add-sg-rule

Switched to a new branch 'future-add-sg-rule'

git status

On branch future-add-sg-rule
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
        modified:   modules/network/security_group.tf
        modified:   envs/prod/terraform.tfvars

Untracked files:
  (use "git add <file>..." to include in what will be committed)
        notes.txt

git status -s

 M envs/prod/terraform.tfvars
 M modules/network/security_group.tf
?? notes.txt

git diff                      # まだ add していない変更
git diff --staged             # add 済み(次の commit に入る)変更

git diff modules/network/security_group.tf

diff --git a/modules/network/security_group.tf b/modules/network/security_group.tf
index 3f2a1b0..8c4d9e7 100644
--- a/modules/network/security_group.tf
+++ b/modules/network/security_group.tf
@@ -12,6 +12,13 @@ resource "aws_security_group" "app" {
     cidr_blocks = ["10.0.0.0/16"]
   }

+  ingress {
+    from_port   = 8443
+    to_port     = 8443
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/16"]
+  }
+
   egress {

git add modules/network/security_group.tf envs/prod/terraform.tfvars

git status -s

M  envs/prod/terraform.tfvars
M  modules/network/security_group.tf
?? notes.txt

git add -p modules/network/security_group.tf

@@ -12,6 +12,13 @@ resource "aws_security_group" "app" {
...
(1/1) Stage this hunk [y,n,q,a,d,s,e,?]? y

git restore --staged notes.txt

git commit -m "app 用 SG に 8443/tcp の ingress を追加"

[future-add-sg-rule 5d1e8a2] app 用 SG に 8443/tcp の ingress を追加
 2 files changed, 8 insertions(+), 1 deletion(-)

git commit

app 用 SG に 8443/tcp の ingress を追加

新しい管理 API が 8443 で待ち受けるため。
VPC 内(10.0.0.0/16)からのみ許可。既存ルールは変更なし。
plan の結果: 1 to add, 0 to change, 0 to destroy
Refs: INFRA-123

git push -u origin future-add-sg-rule

Enumerating objects: 9, done.
Counting objects: 100% (9/9), done.
Writing objects: 100% (5/5), 612 bytes | 612.00 KiB/s, done.
remote: Create a pull request for 'future-add-sg-rule' on GitHub by visiting:
remote:      https://github.com/example/infra/pull/new/future-add-sg-rule
To github.com:example/infra.git
 * [new branch]      future-add-sg-rule -> future-add-sg-rule
branch 'future-add-sg-rule' set up to track 'origin/future-add-sg-rule'.

gh pr create --fill

gh pr merge --squash --delete-branch

git switch main
git pull

Updating 2a9c4f1..7b3e6d0
Fast-forward
 envs/prod/terraform.tfvars          | 1 +
 modules/network/security_group.tf   | 7 +++++++
 2 files changed, 8 insertions(+)

git fetch origin
git merge origin/main

Auto-merging modules/network/security_group.tf
CONFLICT (content): Merge conflict in modules/network/security_group.tf
Automatic merge failed; fix conflicts and then commit the result.

git branch -d future-add-sg-rule
git fetch --prune

git log --oneline --graph --decorate --all

* 7b3e6d0 (HEAD -> main, origin/main) app 用 SG に 8443/tcp の ingress を追加
* 2a9c4f1 prod の ALB ヘルスチェック間隔を 10 秒に変更
| * c8d0e12 (origin/future-rds-backup) RDS のバックアップ保持を 14 日に延長
|/
* 91fb3a7 dev 環境の NAT Gateway を 1 台に削減
* 4e6a0b5 VPC モジュールを v2 に更新

git log --oneline -10                      # 直近 10 件
git log --oneline -- modules/network/      # このディレクトリに触れたものだけ
git log --since="2 weeks ago" --oneline    # 期間で絞る
git log --stat -3                          # 変更ファイルと行数つき

git log --author="sato" --oneline

git blame modules/network/security_group.tf

^4e6a0b5 (Yamada 2026-09-02 10:12:41 +0900 11)     cidr_blocks = ["10.0.0.0/16"]
5d1e8a2a (Sato   2026-10-25 09:30:05 +0900 15)     from_port   = 8443

git show 5d1e8a2

git log -S"0.0.0.0/0" --oneline

d41c7e9 検証用に SSH を全開放
3a8f5b2 SSH の許可元を社内 CIDR に限定

git diff HEAD~1                       # 1 つ前のコミットと現在
git diff 2a9c4f1 7b3e6d0              # 2 つのコミットの差分
git diff main future-rds-backup       # ブランチ同士の差分
git diff 2a9c4f1 7b3e6d0 --stat       # 変更ファイルの一覧だけ
git diff 2a9c4f1 7b3e6d0 -- modules/network/security_group.tf   # 1 ファイルだけ

 envs/prod/terraform.tfvars        | 1 +
 modules/network/security_group.tf | 7 +++++++
 2 files changed, 8 insertions(+)

git show 91fb3a7:modules/network/nat.tf

git switch --detach 91fb3a7

HEAD is now at 91fb3a7 dev 環境の NAT Gateway を 1 台に削減

git switch main

git config --global user.name "Sato"
git config --global user.email "sato@example.com"
git config --global init.defaultBranch main
git config --global pull.rebase false

git config --list --show-origin | grep user

file:/home/sato/.gitconfig    user.name=Sato
file:/home/sato/.gitconfig    user.email=sato@example.com

cd ~/work/infra
git config user.email "sato@company.example"   # --global を付けない

git check-ignore -v secrets.tfvars

.gitignore:11:secrets.tfvars    secrets.tfvars

git rm --cached secrets.tfvars
git commit -m "secrets.tfvars を追跡対象から外す"

git config --global core.excludesfile ~/.gitignore_global
printf '.aws/\n.env\n*.pem\n.DS_Store\n' >> ~/.gitignore_global

git diff --staged --name-only

pip install pre-commit

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks

pre-commit install

git commit -m "provider 設定を追加"

Detect hardcoded secrets.................................................Failed
- hook id: gitleaks
- exit code: 1

Finding:     access_key = "AKIAIOSFODNN7EXAMPLE"
RuleID:      aws-access-token
File:        providers.tf
Line:        4