How GitHub works with AI coding tools
GitHub stores your project's full history. Every change is a commit: a snapshot with a message and an author. AI tools connect to that history and write commits for you, which means your repository is both a backup and the clearest record of what the AI actually changed.
What are the four words you need?
| Term | What it is |
|---|---|
| Repository | The project and its entire history |
| Commit | One saved change, with a message and a parent |
| Branch | A named line of commits you can work on separately |
| Pull request | A proposal to merge one branch into another, with review |
Everything else in Git is an elaboration of these four. You can work productively for months knowing only these.
Why is the commit history the best AI audit trail you have?
A chat transcript tells you what the AI said it did. The diff tells you what it did. When a feature stops working after a session, comparing the last two commits is usually faster than re-reading the conversation — you see the exact lines that changed and nothing else.
- 1Open the repository's commit list.
- 2Find the last commit from before the problem appeared.
- 3Open the next commit and read the diff.
- 4Look specifically for changed config, changed permissions and deleted lines — deletions cause more breakage than additions.
What does an AI tool actually do to my repository?
- Reads files to build context before answering.
- Writes new files and edits existing ones.
- Creates commits, usually with a generated message.
- Sometimes works on a branch and opens a pull request instead of committing directly.
It does this with a token you granted. That token has the permissions you approved — which is worth reading rather than clicking past, since 'write access to all repositories' and 'write access to this one repository' are very different grants.
Do I need branches if I am working alone?
For small changes, no. For anything risky — a payment flow, a database change, a redesign — yes, because a branch gives you a preview deployment and a clean way to abandon the attempt. The cost is one extra click; the benefit is that your live site never sees the experiment.
What breaks most often at this seam?
| Symptom | Usual cause |
|---|---|
| Change is not on the live site | Committed to a branch that is not the deploying branch |
| Change disappeared | A later commit overwrote it, or a merge chose the other side |
| Deployment did not trigger | The integration lost access, or the push went to a fork |
| Secrets in history | A key was committed once and remains in old commits after deletion |
Frequently asked questions
- Is GitHub a backup?
- Of your code, yes, as long as it is pushed. It is not a backup of your database, uploaded files or environment variables.
- Should I read every AI commit?
- Read the diff for anything touching authentication, payments, permissions or configuration. Skim the rest.
- What if I committed a secret?
- Rotate the key immediately. Removing it from the current files does not remove it from history.
Practice this in MessyDev
Reading it once helps. Doing it once sticks. These are the hands-on parts of MessyDev that cover the same ground.
Keep going
- Why isn't my GitHub deployment updating?Your change is committed and the live site is unchanged. Branch, build, cache or domain — how to find out which, in four checks.
- How Lovable, GitHub, Vercel and Supabase work togetherFour tools, four jobs. Where your code lives, where it runs, where your data sits, and what moves between them when you ship a change.
- Common security mistakes in AI-generated appsThe handful of issues that show up repeatedly in generated code — what each one looks like, why it happens, and the check that catches it.