feat: add pre-push gate requiring remote master - #47
Merged
Conversation
Copy the systemfsoftware prepush hook: .husky/pre-push delegates to a Deno guard (scripts/guards/check-remote-master.ts) that refuses any push whose branch ref does not contain the remote trunk tip. Local master is never consulted; the guard fetches refs/heads/master and requires it to be an ancestor of each pushed head. Deletes, tags, and non-head refs are ignored. Adapted to this repo's trunk: the source guard hardcodes refs/heads/main, which is a silent no-op here since comment-checker's default branch is master; renamed to refs/heads/master so the gate actually enforces. Wiring: husky ^9.1.7 devDep with a prepare script installs the hook on pnpm install; arktype@2.2.3 added to scripts/deno.jsonc for the guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A push whose branch is forked from a stale or local trunk can now be rejected before it reaches GitHub. This adds a pre-push gate that refuses any push whose
refs/heads/*does not contain the remotemastertip.Why not the local
master: the local branch lags and is not the source of truth. The gate fetchesrefs/heads/masterfromorigin, requires it to be an ancestor of every pushed head, and only then allows the push. Force-pushes off a stale trunk stop before they are published.What changed
.husky/pre-push— the hook, installed by husky onpnpm install.scripts/guards/check-remote-master.ts— a Deno guard that runs the check (git-only permissions; no network or env access).huskydevDependency, apreparescript, and thearktypedeno import the guard needs.Copied from
systemfsoftware/systemfsoftware. The source guard hardcodesrefs/heads/main, which would silently allow every push here because comment-checker's default branch ismaster; the copied guard was adapted to targetrefs/heads/masterso the gate actually enforces.Deletes, tags, and non-head refs are ignored — only pushed branch heads are gated.
Validation
Exercised the guard directly and through the live husky chain:
master→ allowed (exit 0)master→ refused withpre-push: behind remote master(exit 1)git pushthat opened this PR passed the live hookdeno checkanddeno lintpass on the guard. The cargo gate cannot run on this machine (nocclinker installed); this change touches no Rust.New concepts
Pre-push gate against the remote head. A git pre-push hook receives the refs being pushed on stdin and can exit non-zero to abort the push. The value is checking the remote trunk, not the local one: query
refs/heads/masteron the remote and require it be an ancestor of each pushed head, so a branch forked from a stale or localmasteris refused before it can clobber or force-push the approved trunk. Use it for any repo where a protected trunk must not receive backwards or unreviewed re-bases; skip it when pushes are all fast-forward to a trunk a human reviews in-line.