Separate Git identities by context

Git records author and committer identity in every commit, permanently. A global email can leak into the wrong repository when one Mac serves several contexts: your personal address in the company monorepo, or your work address signed onto a weekend open source contribution.

Once pushed, that history is effectively public within its audience. Prevention beats cleanup here, because cleanup means rewriting shared history.

Find out what Git will use

Inspect the effective value and its source:

git config --show-origin --get user.email
git config --show-origin --get user.name

file:/Users/flavio/.gitconfig   [email protected]
file:/Users/flavio/.gitconfig   Flavio Copes

--show-origin is the useful part: it names the exact file each value came from. When identity is wrong, this tells you which layer — system, global, or repository — to fix.

Switch identity by directory

Use conditional includes for directory-based identities. In ~/.gitconfig:

[user]
  name = Flavio Copes
  email = [email protected]

[includeIf "gitdir:~/work/"]
  path = ~/.gitconfig-work

And in ~/.gitconfig-work:

[user]
  email = [email protected]

Every repository under ~/work/ now commits with the work address; everything else keeps the personal one. The rule is enforced by directory layout, not by memory — which is the point, because memory is what failed in the first place.

Two details trip people up. The trailing slash in gitdir:~/work/ matters: it makes the pattern match everything under that directory. And the condition is evaluated against the repository you are inside, so testing it from your home directory tells you nothing.

Verify before the first commit

Before the first commit in a new repository, confirm the effective configuration from inside that repository:

cd ~/work/new-api
git config --show-origin --get user.email
# file:/Users/flavio/.gitconfig-work  [email protected]

The realistic failure: you clone a work project to ~/dev/ instead of ~/work/, the include never matches, and three weeks of commits carry your personal email. The five-second check above, run once after every clone, is the whole defense.