Stash, Worktrees, Temporary Work, and Parallel Development Contexts: Configuration, Design Choices, and Tradeoffs
Design maintainable stash/worktree policy around descriptive messages, short retention, sibling directory naming, worktree-specific config, durable-commit thresholds, and CI isolation tradeoffs.
Learning objectives
- Define stash naming and retention rules that prevent hidden local work from becoming a backlog.
- Use predictable, cross-platform sibling worktree directory conventions.
- Explain extensions.worktreeConfig and git config --worktree as version-sensitive opt-in behavior.
- Choose commit, stash, worktree, or clone based on durability and isolation requirements.
- Compare shared worktrees with clean clones for CI performance, reproducibility, and security boundaries.
1. Context management needs conventions because both tools create hidden state
A stash hides work from normal branch history; a linked worktree hides a checkout in another directory. Neither is unsafe by definition, but unmanaged copies make it easy to forget where important work lives. A useful policy makes temporary state discoverable, short-lived, named, and convertible to durable history when its lifetime grows.
2. Give every nontrivial stash an operational message
git stash push -u -m "INC-142 | feature/metrics | interrupt for hotfix | includes notes"
git stash list
git stash show --stat stash@{0}
A message should answer why the work was parked and what context it
belongs to. Avoid messages like wip when several
stashes can coexist. The message is not a replacement for issue
tracking, but it reduces ambiguity when you inspect the stack later.
3. Stash retention discipline: hours/days, not an archive strategy
Stashes are local ref/reflog state. Dropping or clearing entries can make their commits unreachable and eventually prunable. If temporary work survives a context switch, a reboot, a handoff boundary, or more than the team's short-lived stash window, promote it to a named branch and commit it intentionally.
| Condition | Keep as stash? | Better next step |
|---|---|---|
| Ten-minute interruption | Usually reasonable | Named stash; inspect before pop |
| Work must be reviewed or handed off | No | Commit to a branch |
| Work may be needed next week | Poor choice | Durable branch/commit + issue context |
| Contains a secret accidentally | No safety benefit | Rotate/revoke secret; remediate history/state properly |
4. Use predictable sibling directories for worktrees
A common layout keeps linked worktrees adjacent to the main repository:
service/
service-wt-feature-metrics/
service-wt-review-842/
service-wt-hotfix-timeout/
Predictable names make shell prompts, IDE windows, cleanup scripts, and incident runbooks easier to audit. Keep names portable across Windows, Linux, and macOS: avoid shell metacharacters, reserved platform-specific names, and ambiguous spaces when automation will consume paths.
5. Worktree-specific config is an opt-in repository-format extension
By default, repository config is shared across worktrees. Current
Git supports extensions.worktreeConfig, after which
git config --worktree writes configuration specific to
one worktree.
git config extensions.worktreeConfig true
git config --worktree devops.context main
git config --show-origin --show-scope --get devops.context
git worktree add -b hotfix/example ../service-wt-hotfix trunk
git -C ../service-wt-hotfix config --worktree devops.context hotfix
git -C ../service-wt-hotfix config --show-origin --get devops.context
devops.context is a harmless custom key used for
teaching. Real Git settings such as sparse-checkout state may
legitimately differ per worktree, but do not scatter arbitrary
behavioral configuration across worktrees without documenting it.
6. Know what remains shared
Enabling worktree-specific config does not turn a linked worktree into an independent clone. The object database and shared repository configuration/refs still belong to the common repository. A command in one worktree can create commits or update branch refs visible from another.
git rev-parse --git-dir
git rev-parse --git-common-dir
git config --list --show-origin --show-scope
7. Decision rule: stash only when hidden local state is truly temporary
- If the work is coherent enough to explain and must survive or be shared, commit it on a branch.
- If the work is incomplete but interruption is short and strictly local, stash it with a message.
- If current work should remain physically untouched while another branch is needed immediately, add a worktree.
- If independent dependencies, credentials, build caches, or isolation boundaries are required, use a fresh clone/workspace.
8. Worktrees versus clean clones in CI
| Dimension | Shared worktrees | Clean clones/workspaces |
|---|---|---|
| Object download/disk | Efficient: shared object database | Higher cost unless cache/reference mechanisms are used |
| Checkout/index isolation | Separate | Separate |
| Repository config/refs | Mostly shared | Independent |
| Failure blast radius | One repository's ref/config/maintenance state can affect contexts | Stronger isolation |
| Reproducibility | Requires disciplined cleanup and exact OID checkout | Easier to reason about as fresh environment |
| Best fit | Controlled local build farms or developer parallelism | Security-sensitive/untrusted or strongly isolated CI jobs |
Do not choose worktrees for CI merely because they are faster. If jobs run untrusted code, need independent credentials, or mutate repository config/refs unpredictably, clean isolation is often worth the extra cost.
9. Lock only worktrees that are intentionally unavailable, and record why
git worktree lock --reason "portable SSD disconnected during travel" /path/to/worktree
git worktree list --porcelain
git worktree unlock /path/to/worktree
A lock prevents pruning and ordinary move/remove operations. It is not a file lock that prevents developers from editing files inside a mounted worktree.
10. Prune metadata only after verifying the directory is genuinely gone
git worktree list --porcelain
git worktree prune --dry-run
git worktree prune -v
The dry-run is the same safety principle used throughout this
course: inspect what Git believes is stale before changing
administrative state. If the directory was moved rather than
deleted, use git worktree repair instead of pruning the
relationship.
11. Security boundary: worktrees share more than their filenames suggest
Linked worktrees share the common repository, including objects that may contain historical sensitive data. They are not a security boundary between trusted and untrusted jobs. Likewise, repository-local config is shared by default. Secrets should come from an external secret manager/environment with least privilege, not from committed files or casual per-repository config.
12. Worked scenario — a small DevOps team
| Event | Selected context tool | Rationale |
|---|---|---|
| Developer interrupted for 30-minute review | Named stash or leave feature worktree untouched | Private, short-lived state |
| Urgent hotfix while feature tree contains many edits | New hotfix worktree | No need to disturb feature files/index |
| Fix needs teammate validation | Commit + branch | Durable/shareable review history |
| CI runs pull-request code from untrusted forks | Fresh isolated workspace/clone | Avoid shared repository/config blast radius |
| Review snapshot on removable drive | Locked worktree with reason | Prevent metadata pruning while temporarily offline |
13. Knowledge check
Question 1. Why are descriptive stash messages operationally useful?
Question 2. What enables git config --worktree to
have independent values?
extensions.worktreeConfig; verify version
compatibility before enabling it.
Question 3. Why is a worktree not equivalent to a clean CI clone?
Question 4. When should a stash become a branch/commit?
Question 5. If a linked worktree directory was moved manually, should you prune it?
git worktree repair to reconnect the
moved directory when the worktree still exists.
14. Summary
Manage temporary contexts with naming and lifetime rules. Use worktree-specific config only when version compatibility and a real per-worktree need justify it. Prefer commits for durable work, linked worktrees for parallel local checkout contexts, and clean clones for stronger CI isolation.
Authoritative references
Keep the academy open
Support free, practical DevOps education.
Every lesson is designed to remain readable in a browser, downloadable from GitHub, and usable without a paid learning platform. Contributions help expand and maintain the curriculum.
0x716c4Ab160C4B66F31a28AE2448BfF68fc3a2ef0
Send only Ethereum/ERC-20 compatible assets to this
address.