Set Up Automatic Git Commit Timestamping in Minutes

Set Up Automatic Git Commit Timestamping in Minutes

If you’ve ever tried to prove when a piece of code was written, you know the manual dance: run a timestamping command after every important commit, store the receipt somewhere durable, remember which files are covered, and hope you didn’t skip the one commit that later becomes the center of a dispute. It’s repetitive, error-prone, and nearly impossible to sustain across a real project lifespan.

Automatic Git commit timestamping removes that burden entirely. With the right managed service, it becomes a one-time setup that takes minutes — not an ongoing chore. Timestamp GIT provides exactly that: a GitHub App that anchors your commit hashes to the Bitcoin blockchain every night, without you touching a CLI or managing receipt files.

This article walks through the setup, the automated pipeline, monitoring, and best practices so you can set it and forget it.

The Repetitive Task You Can Eliminate

Traditional timestamping workflows force developers into a loop of manual steps:

• Run a timestamping tool after each commit (or risk missing important ones)
• Keep track of .ots receipt files across machines and repositories
• Remember which commits have been anchored and which haven’t
• Re-run the process every time you push to a new branch or repo
• Manually verify receipts when you need to prove prior art

This is fragile. Humans forget. Receipts get lost. The whole idea of proving “I wrote this code on this date” collapses when the process depends on memory and discipline.

You could run the underlying OpenTimestamps protocol yourself, but that means scripting around CLI commands, handling receipts, and tracking blockchain confirmations. That’s the hard way — and it’s precisely what Timestamp GIT eliminates.

Timestamp GIT automates every step: once the GitHub App is installed, every commit to a monitored repository is collected, batched, and anchored into Bitcoin each night. You never run a command, manage a receipt, or remember to timestamp anything. It’s automatic Git commit timestamping in the truest sense.

For a detailed walkthrough of the installation itself, see Install a GitHub App for Automatic Code Timestamping. This article focuses on the end-to-end setup and the automation that runs afterward.

One-Time Setup: Connect Your Repository

Setup takes a few minutes. Here’s the flow:

1. Install the Timestamp GIT GitHub App from the GitHub Marketplace.
2. Select the repositories you want to monitor. Public or private repos are supported depending on your plan.
3. Choose your permission model:
   • Standard mode: The GitHub App requires read-only access to the source repository. It reads only the HEAD commit hash — never file contents.
   • Enterprise ZK mode: No read access to source code at all. A GitHub Action on your infrastructure pushes only the commit hash to the Timestamp GIT API. Your source code never leaves your environment.
4. Confirm the installation.

After that, there are no further manual steps. The system watches the repository, detects new commits automatically, and runs the timestamping pipeline each night.

If you’re self-hosting via the Docker image, a setup wizard guides you through connecting the GitHub App and configuring the instance. For most teams, the SaaS GitHub App is the fastest path.

The Automated Pipeline: From Commit to Bitcoin Anchor

Here’s what happens after you connect a repository:

Nightly batching

Every commit hash is stored in an in-memory queue as it arrives. Each night, a worker runs and groups all pending hashes for each repository. It creates manifest files (.txt), builds a Merkle tree natively, and generates OpenTimestamps proofs using public calendars.

The Merkle root of the daily batch is then anchored into a Bitcoin block via the OpenTimestamps protocol. Once confirmed in the blockchain, the timestamp becomes immutable — no entity, including Timestamp GIT, can alter or forge it.

Proof delivery

After the anchor is confirmed (typically around 3 hours), Timestamp GIT pushes the manifest and .ots receipt files back to your repository in a dedicated timestamps branch or a shadow repository. You don’t have to retrieve anything manually; the proof is versioned right alongside your code.

Enterprise ZK mode in 12 lines

If you can’t grant read access to your source code, Enterprise ZK mode uses a GitHub Action that runs on your infrastructure. It pushes only the commit hash to the API. Here’s a minimal working example:

name: Timestamp commit hash
on: [push]
jobs:
  anchor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -X POST "https://timestampgit.dev/api/timestamp/${{ github.repository }}/${{ github.ref_name }}/${{ github.sha }}/${{ secrets.TIMESTAMPGIT_HMAC }}"

That’s the entire action. The actual template is provided during Enterprise ZK setup, but the principle is simple: send the commit ID and a signed HMAC to the API, and nothing else leaves your environment.

REST API for status, verification, and audit

The automation extends to reporting. Public endpoints let you query the proof state without logging into a dashboard:

# Last anchored Bitcoin block information
curl https://timestampgit.dev/api/statusLast/your-org/your-repo

# Total committed/stamped commit count
curl https://timestampgit.dev/api/statusCount/your-org/your-repo

# Combined summary for Shields.io badges
curl https://timestampgit.dev/api/statusSummary/your-org/your-repo

# Download full audit ledger as CSV
curl -O https://timestampgit.dev/api/audit/your-org/your-repo

# Download PDF certificate for a specific date
curl -O https://timestampgit.dev/api/report/your-org/your-repo/2026-08-19

For private repositories, these URLs include an encrypted HMAC specific to your instance, so only authorized users can access the status. All of this is automatic — no developer intervention required.

Monitoring and Failure Handling

Once the pipeline is running, you need visibility into proof status and a way to detect problems.

Public status dashboard

Each repository gets a public dashboard at https://timestampgit.dev/status/{user}/{repo}. It shows:

• Proof longevity and earliest anchor date
• Daily regularity of commits and anchors
• Bitcoin block and transaction data for each anchor
• A calendar heatmap of timestamping activity

You can also download an audit CSV and a PDF certificate for any date. These are useful for compliance and offline record-keeping.

Embeddable verification badges

Timestamp GIT provides badge snippets that you can paste into your README. The badge displays live verification status and links to a public verification page where anyone can inspect the Merkle chain. The page performs all computation locally in the browser — zero-knowledge verification.

Handling delays and missed days

Bitcoin confirmation takes time, normally around 3 hours. The system handles this delay automatically; your proof is written once the anchor is confirmed. If you commit after the nightly cutoff, the hash is included in the next day’s batch.

If a day has no commits, no timestamp is generated for that day. Existing proofs remain valid; the system simply skips the empty batch.

For private repos, HMAC-signed URLs protect access to status and verification pages. Only people with the right HMAC can see the proof state.

Best Practices for Reliable Timestamping

To get the most out of automatic Git commit timestamping, follow these guidelines:

• Commit regularly. The system anchors whatever hashes are pending each night. Daily commits mean daily anchors, building a continuous record.
• Keep the proof branch or shadow repository intact. Do not delete .ots files or the timestamps branch. Those are your evidence.
• Use Enterprise ZK mode when source access is restricted. If you can’t grant read access to the source repo, the GitHub Action approach keeps code local while still anchoring hashes.
• For air-gapped or high-security environments, consider the Docker self-hosted license. You can run Timestamp GIT entirely on your own infrastructure with a Docker Compose file.
• Periodically download audit CSVs and PDF certificates. Store them in a separate archival location for legal or compliance purposes.
• Monitor the dashboard heatmap. A gap in the heatmap tells you that no commits were anchored that day — either because there were no commits or because something went wrong. The dashboard makes this obvious.

FAQ

How does automatic Git commit timestamping work?

Timestamp GIT uses a GitHub App to detect new commits automatically. Each night, it collects commit hashes, builds a Merkle tree, and anchors the root into the Bitcoin blockchain via OpenTimestamps. Proof receipts (.ots files) are pushed back to your repository, providing immutable evidence of existence.

Is my source code ever exposed to Timestamp GIT?

No. In standard mode, the GitHub App only reads commit hashes, not file contents. In Enterprise ZK mode, a GitHub Action on your infrastructure pushes only hashes to the API, so your source code never leaves your environment.

What happens if I miss a day of commits?

If no commits are made on a given day, no timestamp is generated for that day. The system anchors only the hashes of commits that occurred. Your existing proofs remain valid, and future commits will be timestamped automatically.

Can I verify timestamps without relying on Timestamp GIT’s servers?

Yes. The .ots receipt files can be verified independently using standard OpenTimestamps tools against the Bitcoin blockchain. Timestamp GIT also provides a browser-based verification page that performs all computations locally.

Set It and Forget It

Automatic Git commit timestamping turns a tedious, error-prone chore into a background process. You install the GitHub App once, connect your repositories, and every commit is anchored to Bitcoin nightly — no manual commands, no receipt management, no remembering.

Timestamp GIT is the managed service that makes this possible. It hides the complexity of OpenTimestamps behind a clean GitHub App, delivers proofs directly to your repository, and gives you dashboards, badges, and APIs for verification. Ready to start? Install the GitHub App, connect a repository, and let the nightly anchoring begin.

Related posts

• Install a GitHub App for Automatic Code Timestamping