Ah ok, I think I understand the concern. So 'git fetch' and 'git merge' explicitly will stop an upstream rebase from making destructive changes to the history of your local branch(?)
As you say it's bad practice and shouldn't happen. I use gitlab and GitHub where branches can be protected to only allow merges via their web interfaces.
On the page where the ssh finger print is listed, can you list the RSA finger print too?
I am not well versed in working with git over ssh, but after following the instructions on GitLab to generate a key, then git would keep showing me the RSA finger print which doesn't match the one provided on the website. After looking around a bit, it looks like the one listed is ECDSA.
tl;dr: It was late. Finger prints didn't match. Only logical assumption was NSA. :P (Not really, obviously, but the finger prints could be more clear.)
I don't think git pull would ever destroy your history (AFAIK it's exactly the same as a fetch+merge), at worst you end up in a merge conflict, but it's easily revertable. However after a git fetch and a git log you can see beforehand if there is anything nasty going on.
Nothing unless you're rebasing upstream, but I think the point he was trying to make was that you should always run `git fetch` and then `merge` from there (again, there are some situations where the pull is fine IMHO).
nothing. but tomorrow, when you are used to type git pull, you will run it on a branch with changes and you have no idea if it will rebase, merge, fast forward... and /then/ you will see the problem. (and open yet another stackoverflow question on how to undo the last merge :)
Genuine question: what's wrong with executing 'git pull' on a branch you haven't changed locally?