Automate Git Commit Timestamping with a GitHub App
If you have ever tried to prove when a Git commit existed, you already know the manual drill: extract commit hashes, build a manifest, wait for confirmations, store receipt files somewhere safe, and repeat. It is repetitive, easy to forget, and it falls apart the moment more than one repository or team member is involved.
There is a better way to automate bitcoin timestamping for git commits with a GitHub App. Timestamp GIT turns proof-of-existence into a background service: install the GitHub App once, connect a repository, and every commit is anchored to the Bitcoin blockchain nightly. You do not need to run raw protocol tools, remember cron jobs, or become a blockchain expert. The raw OpenTimestamps workflow exists, but doing it by hand is the hard way.
This article walks through the automation workflow, the one-time setup, what happens between commit and Bitcoin anchor, and how to monitor and use the resulting proofs.
The Manual Timestamping Grind You Can Eliminate
The manual process for timestamping Git commits usually looks like this:
- Wait until you remember that a commit should have been timestamped.
- Extract the commit hash from Git.
- Prepare a file containing the hashes you want to prove existed.
- Run a timestamping tool against that file.
- Wait for the proof to be created and confirmed.
- Store the receipt somewhere durable.
- Hope that nobody asks you to explain the exact steps later.
That workflow has three serious problems.
First, developers forget to timestamp. Proof of existence only helps if the timestamp was created before the dispute. If you remember three months after the fact, the evidence may be weaker than it could have been.
Second, proofs get lost. A receipt file saved to a laptop, an old backup drive, or a random channel is not an audit trail. In a legal or compliance context, missing receipts look like missing evidence.
Third, manual steps do not scale. A solo developer can occasionally timestamp a release commit. A startup with 15 repositories, multiple contributors, and daily merges cannot rely on someone manually exporting hashes every evening.
Timestamp GIT automates the entire OpenTimestamps protocol behind a managed service. The product does not read your source code. It collects only commit hashes, batches them, and creates cryptographic proofs that are embedded in the Bitcoin blockchain. You never touch a CLI, you never build a Merkle tree, and you never babysit a confirmation process.
One-Time Setup: Connect Your Repository
The setup path is designed to be done once and then forgotten.
You start by installing the Timestamp GIT GitHub App and selecting the repositories you want monitored. Public repositories can be covered by the free Open Source plan. Private repositories are available on the Pro Agency or Enterprise ZK plans.
Timestamp GIT offers two deployment modes.
Standard Mode
In Standard Mode, the GitHub App monitors your repository through GitHub webhooks. When a new commit appears, the app reads the HEAD commit hash only.
GitHub permissions require read-only access to the source repository because GitHub does not offer a commit-hash-only access scope. Timestamp GIT also needs read-write access to the target repository where proofs will be written. The proof branch can live in the same repository or in a separate shadow repository.
The important part: your source code is never read, copied, or stored. Only commit hashes enter the Timestamp GIT pipeline.
Enterprise ZK Mode
Enterprise ZK Mode is for teams that cannot grant any repository read access to a third party. Instead, a 12-line GitHub Action runs on your own infrastructure and pushes only the commit hash to the Timestamp GIT API.
In this mode, Timestamp GIT needs read-write access only to the target repository where proofs are stored. It does not need read access to the source repository. Your source code never leaves your environment.
After the initial connection, there are no manual steps. Every commit to a monitored repository is picked up automatically.
The Automated Pipeline: From Commit to Bitcoin Anchor
Once a repository is connected, the automation pipeline handles the rest.
The pipeline works like this:
-
Commit detection
The GitHub App detects new commits through webhooks, or your GitHub Action pushes commit hashes to the API. -
Hash queue
Commit hashes are stored in an in-memory key-value store for batching. -
Nightly batch
Each night, a worker groups pending hashes and creates a manifest.txtfile for each repository. -
Merkle tree and OpenTimestamps
Timestamp GIT builds a Merkle tree natively, creates OpenTimestamps proofs using public calendars, and anchors the Merkle root into the Bitcoin blockchain. -
Proof delivery
The manifest and.otsreceipt files are pushed back to a dedicated timestamps branch or shadow repository.
Bitcoin confirmation typically takes a few hours, normally around three hours. That means proofs are usually available the next day after the nightly batch is submitted.
You can check the current status of a repository through the public API:
curl -s https://timestampgit.dev/api/statusLast/acme/widget-api
curl -s https://timestampgit.dev/api/statusCount/acme/widget-api
curl -s https://timestampgit.dev/api/statusSummary/acme/widget-api
Private repositories append an encrypted HMAC to these URLs, so only authorized users can see the status. The HMAC is specific to the Timestamp GIT server instance.
The API also exposes verification and reporting endpoints:
GET /api/verify/{user}/{repo}/{date}returns the full Merkle chain data for local verification of a specific day.GET /api/audit/{user}/{repo}downloads the full audit ledger as CSV.GET /api/report/{user}/{repo}/{date}downloads a PDF certificate for a specific date.
The repository management endpoint, GET /api/repos/{user}, lists monitored repositories after GitHub App installation.
For Enterprise ZK Mode, the setup wizard provides a signed URL. The GitHub Action posts only the commit identifier to that URL. The workflow is intentionally small, with no source checkout required beyond the event payload already available in GitHub Actions.
Monitoring and Failure Handling
Automation should be observable. Timestamp GIT provides a public status dashboard for each repository.
The dashboard includes:
- Proof longevity
- Earliest anchor date
- Daily regularity
- Bitcoin block and transaction data
- A calendar heatmap
- Downloadable audit CSV
- PDF certificate downloads
You can also embed a verification badge in your README. The authenticated GET /api/badgeLink/{user}/{repo} endpoint returns badge URLs and ready-to-use Markdown snippets for Shields.io. The badge publicly displays verification status and links to the verification page.
If Bitcoin confirmation takes longer than expected, the status dashboard shows where the proof is in the process. Because the system batches nightly, a slow confirmation usually means the proof appears a few hours later than normal rather than disappearing. The queued hashes remain in the pipeline, and you can check the status page for the current state.
The important guarantee: your proof is not dependent on Timestamp GIT remaining available. The .ots files are stored in your repository, and the proof relies only on SHA-256 and Bitcoin block data. You can verify it locally even if the company disappears.
Best Practices for Automated Timestamping
Automation removes the manual burden, but a few habits make the evidence stronger.
Timestamp every commit, not just releases.
Releases are useful milestones, but a continuous chain of commit hashes creates a much richer record. If a dispute is about a specific implementation detail, a release-level timestamp may be too coarse.
Use a dedicated shadow repository for proofs.
Keeping .ots files and manifest files in a separate proof repository keeps your main repository clean. It also makes audit collection easier because all proof data lives in one place.
Consider Docker self-hosting for air-gapped environments.
Timestamp GIT is available as a Docker image for teams that need maximum control. The quick-start configuration is:
services:
timestampgit:
image: rue1401/timestampgit:prod
ports:
- "8080:8080"
volumes:
- ./data:/app/data
restart: unless-stopped
valkey:
image: valkey/valkey:8
restart: unless-stopped
docker compose pull
docker compose up -d
docker compose logs -f timestampgit
The application is available at http://localhost:8080 after startup. A setup wizard guides you through connecting your GitHub App and configuring the instance. A time-limited demo license is available from the Docker license page.
Download audit reports regularly.
Treat the CSV audit ledger and PDF certificates as legal documents. Store them with your other IP protection records. Do not wait for a dispute to start collecting evidence.
Combine timestamping with other IP protection strategies.
Timestamping is not a replacement for patents, contracts, or trade-secret policies. It is the cryptographic proof that makes those other strategies much harder to challenge.
FAQ
Does the GitHub App need access to my source code?
No. In Standard Mode, the GitHub App only reads the HEAD commit hash, not the code itself. In Enterprise ZK Mode, a GitHub Action on your infrastructure pushes only the commit hash to the API, so the source code never leaves your environment.
How long does it take for a commit to be timestamped?
Commits are batched nightly. The Bitcoin anchoring process typically takes a few hours after the batch is submitted, so proofs are usually available the next day. You can check the status dashboard for real-time updates.
Can I verify the timestamp without relying on Timestamp GIT?
Yes. The proof is a standard OpenTimestamps .ots file that can be verified independently using public tools and the Bitcoin blockchain. Timestamp GIT also provides a browser-based verification page and downloadable PDF certificates.
What happens if Timestamp GIT goes out of business?
Your proofs remain valid because they are anchored in the Bitcoin blockchain and use only open standards such as SHA-256 and OpenTimestamps. You can verify them offline at any time, and the .ots files are stored in your repository.
Automate the Proof, Keep the Control
Manual timestamping is easy to sell internally and hard to sustain in practice. The value of proof-of-existence comes from consistency: every commit, every day, with no missing receipts.
Timestamp GIT turns that into a background process. Install the GitHub App once, connect your repositories, and the nightly pipeline handles commit hashes, Merkle trees, OpenTimestamps proofs, Bitcoin anchoring, and proof delivery. You monitor the results through a dashboard, badges, CSV audits, and PDF certificates.
Public repositories can start free. Private repositories are covered by Pro Agency and Enterprise ZK. If you need air-gapped control, the Docker self-hosted license puts the same automation inside your own infrastructure.
Start with Timestamp GIT and make proof-of-existence a normal part of your commit workflow.
Related posts
- OpenTimestamps Alternative: Managed Timestamping for Git
- Code Protection for Freelancers: A Timestamping Solution
- How Bitcoin Can Prove Your IP Existed First
