The Best GitHub App for Timestamping Your Commits
Manually timestamping Git commits is the kind of task that seems simple until you need to do it consistently. You commit code, remember to stamp the hash, keep the receipt somewhere safe, and repeat that process for every repository, every client project, and every internal milestone. Miss one day, and you have a gap in your prior-art trail exactly when a patent troll or contract dispute lands in your inbox.
Timestamp GIT changes that equation. Instead of running a manual timestamping process after each commit, you install a GitHub App once. After that, every commit to a monitored repository is collected, batched, and anchored into the Bitcoin blockchain automatically each night. There is no CLI to run, no receipt folder to maintain, and no manual verification step.
For background on why this matters, see our article on cryptographic prior art for software. Here, the focus is narrower: why Timestamp GIT is the best GitHub App for timestamping when your priority is automation.
One-Time Setup: Install the GitHub App and Forget It
Timestamp GIT is available as a GitHub App. You install it once, choose which repositories it should monitor, and the rest of the pipeline runs without further manual work.
The setup flow is intentionally minimal:
- Install the Timestamp GIT GitHub App from the product site.
- Select all repositories or only the ones that need timestamping.
- Grant the required repository permissions depending on your deployment mode.
- Confirm the target location for proof files.
After that, new commits are detected automatically. There is no local daemon, no pre-commit hook, and no OpenTimestamps command to learn.
Standard Mode
In Standard Mode, the GitHub App reads only the HEAD commit hash from the monitored repository. It does not read file contents, branches, issues, or source code. The proof files are pushed to a dedicated timestamps branch in the same repository or to a separate shadow repository, depending on how you configure it.
The permission model is simple:
- The source repository needs read-only access, because GitHub does not offer a commit-hash-only permission.
- The target repository needs read-write access so Timestamp GIT can push proof files.
Enterprise ZK Mode
For teams that need zero source-code access from the SaaS side, Timestamp GIT offers Enterprise ZK Mode. A 12-line GitHub Action runs on your own infrastructure and pushes only the commit hash to the Timestamp GIT API. The source code never leaves your environment, and Timestamp GIT never receives read access to the source repository.
Enterprise ZK Mode is the right choice for proprietary systems, security-sensitive codebases, and compliance teams that require on-premises or CI-level isolation.
The Automated Pipeline: From Commit to Bitcoin Anchor
The core value of Timestamp GIT is that the entire proof pipeline runs on autopilot. You do not need to understand Merkle trees, Bitcoin transactions, or OpenTimestamps to get court-ready evidence. The application handles all of that behind the scenes.
What Happens After You Commit
Here is the nightly flow:
-
Commit detection
In Standard Mode, the GitHub App detects new commits through webhooks. In Enterprise ZK Mode, your GitHub Action pushes the commit hash to the Timestamp GIT API. -
Hash queuing
Commit hashes are stored in an in-memory key-value store, waiting for the next batching cycle. -
Midnight batching
A daily cron worker groups all pending hashes, creates a manifest file for each repository, builds a Merkle tree, creates OpenTimestamps proofs through public OTS calendars, and anchors the Merkle root into a Bitcoin block. -
Proof delivery
The manifest and.otsreceipt files are pushed back to your selected target: a dedicated timestamps branch or a shadow repository.
Bitcoin confirmation normally takes around three hours, so proof files appear a few hours after the nightly anchor. That delay is expected and does not require any action from you.
Zero-Knowledge by Design
Timestamp GIT never sees, copies, or stores your actual source code. In both deployment modes, only commit hashes are processed. The hash is a one-way fingerprint of the repository state; it cannot be reversed into source code.
This matters for two reasons. First, it protects trade secrets. Second, it makes the proof stronger: Timestamp GIT cannot be accused of having influenced or altered the content you created.
Using the API for Custom Integrations
If you want to automate monitoring or pull status into your own internal tooling, Timestamp GIT exposes public REST endpoints.
For example, you can check the last anchored Bitcoin block for a public repository:
curl -s https://timestampgit.dev/api/statusLast/acme/widget-api
You can also pull a summary that combines total commits and status data:
curl -s https://timestampgit.dev/api/statusSummary/acme/widget-api
Private repositories use signed URLs with an encrypted HMAC. You get those URLs from the dashboard, so your automation scripts can still monitor private repos without exposing status data to the public.
The Hard Way vs. the Timestamp GIT Way
The manual path involves running OpenTimestamps commands, managing receipts by hand, and remembering to repeat the process for every commit. That may be acceptable for a one-off experiment, but it fails as a long-term prior-art strategy. Timestamp GIT replaces that entire workflow with one GitHub App installation and a nightly batch job.
Monitoring and Failure Handling: Stay in Control
Automation does not mean giving up visibility. Timestamp GIT provides several ways to confirm that timestamping is happening on schedule.
Public Status Dashboard
Each connected repository has a public status dashboard. It shows:
- Proof longevity
- Earliest anchor date
- Daily regularity
- Bitcoin block and transaction data
- A calendar heatmap of anchored days
The dashboard is the fastest way to spot a gap. If you expected an anchor and do not see one, the problem is usually a repository permission change or a failed webhook delivery.
Verification Badges
Timestamp GIT provides embeddable Shields.io badges for your README. The badge displays live verification status and links to a public verification page. That is useful for open source projects and for agencies that want to show clients the timestamp is current.
A separate badge endpoint returns badge URLs and Markdown snippets after authentication, so you can paste the correct embed code directly into a README without manual URL construction.
Audit Files and PDF Certificates
For compliance, you can download two artifacts:
- A full audit ledger as CSV
- A PDF certificate for a specific date
The audit CSV gives you a complete, reviewable history of anchors. The PDF certificate is the document you attach to a contract deliverable or an IP file.
For Enterprise ZK Mode, standard CI logs show the GitHub Action runs. If an action fails, the logs identify the failed step before the nightly batch window closes.
Best Practices for Automated Timestamping
Automation removes the manual burden, but a few habits will make your timestamp trail stronger.
1. Enable Timestamping for Internal Repositories Too
Many teams only timestamp public or client-facing projects. That misses the point. Internal tools and trade-secret implementations are exactly the kind of prior art that patent trolls target. Enable the GitHub App on internal repositories as well.
2. Use Enterprise ZK Mode for Highly Sensitive Code
If a repository contains unreleased product logic or regulated data, do not grant read access to a third-party GitHub App. Use Enterprise ZK Mode so only the commit hash leaves your infrastructure.
3. Review the Dashboard Regularly
Nightly automation should not be treated as set-and-forget without periodic review. Check the calendar heatmap and daily regularity view once a week or once a month. A missing day is easier to fix before it becomes a legal problem.
4. Keep Receipts and Audit Logs in a Safe Place
The .ots files and audit CSVs are your proof. Even though Timestamp GIT stores them, keep copies in your own compliance archive. For high-value projects, download the PDF certificate at major milestones.
5. Consider Docker Self-Hosting for Air-Gapped Environments
Some organizations cannot send any metadata outside their network. Timestamp GIT is available as a Docker image for self-hosted deployments. If you need that level of control, see our guide on self-hosted timestamping with Docker.
6. Deliver Proof to Clients
Agencies and freelancers can include Timestamp GIT PDF certificates as part of a milestone or final delivery package. It turns the timestamp from an internal safety net into a client-facing proof of work.
FAQ
How does the GitHub App for timestamping work?
The Timestamp GIT GitHub App monitors your repositories for new commits. Each night, it collects the commit hashes, creates a Merkle tree, and anchors the root into the Bitcoin blockchain using the OpenTimestamps protocol. You receive an immutable .ots receipt file as proof.
Does the GitHub App see my source code?
No. In Standard Mode, the app only reads the HEAD commit hash, not the code itself. In Enterprise ZK Mode, a GitHub Action runs on your infrastructure and pushes only the commit hash to the API, so your source code never leaves your environment.
What if Timestamp GIT goes out of business? Can I still verify my timestamps?
Yes. The proofs are based on open standards: SHA-256 and Bitcoin block data. You can verify any .ots receipt independently using standard OpenTimestamps tools against the Bitcoin blockchain, without relying on Timestamp GIT’s servers.
Is the GitHub App free?
Timestamp GIT offers a free tier for public repositories. For private repositories, there is a Pro Agency plan at $49/month and an Enterprise ZK plan at $199/month with GitHub Actions integration and zero code access.
Conclusion: Automate Your Prior Art Protection Today
Timestamp GIT is the best GitHub App for timestamping because it removes the manual work entirely. You install the app once, connect your repositories, and receive nightly Bitcoin-anchored proofs without running commands, managing receipts, or thinking about Merkle trees.
The pricing is straightforward:
- Open Source: free for public repositories
- Pro Agency: $49/month for private repositories
- Enterprise ZK: $199/month for GitHub Actions integration and zero source-code access
If you need self-hosting or an air-gapped setup, the Docker image is available as an alternative deployment path.
Ready to start? Install the GitHub App from timestampgit.dev and your next commit will be part of the nightly anchor batch.
Related posts
- Bitcoin Timestamping for Developers: A Beginner’s Guide
- Self-Hosted Timestamping with Docker: Timestamp GIT
- How to Prove Software Authorship: A Guide for Developers
