Skip to content

fix: make the pre-push hook actually guard the default branch #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oddurs merged 1 commit into from
Sep 11, 2026
Merged

fix: make the pre-push hook actually guard the default branch #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 15 additions & 12 deletions .githooks/pre-push
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,22 @@
set -eu

remote=$1
default=$(git symbolic-ref --quiet --short "refs/remotes/$remote/HEAD" 2>/dev/null | sed "s|^$remote/||" || echo main)

while read -r _local_ref local_sha remote_ref _remote_sha; do
case "$remote_ref" in
"refs/heads/$default")
# Allow only the push that creates the branch on the remote.
if git ls-remote --exit-code --heads "$remote" "$default" >/dev/null 2>&1; then
echo "pre-push: $default advances only through a merged pull request" >&2
exit 1
fi
;;
esac
[ "$local_sha" = "0000000000000000000000000000000000000000" ] && continue
# Assign, then test. Piping git into sed and falling back with || cannot work:
# sed succeeds even when git failed, so the fallback never fires and the answer
# is silently empty — which makes every guard below match nothing.
default=$(git symbolic-ref --quiet --short "refs/remotes/$remote/HEAD" 2>/dev/null || true)
default=${default#"$remote/"}
[ -n "$default" ] || default=main

while read -r _local_ref _local_sha remote_ref _remote_sha; do
if [ "$remote_ref" = "refs/heads/$default" ]; then
# Allow only the push that first creates the branch on the remote.
if git ls-remote --exit-code --heads "$remote" "$default" >/dev/null 2>&1; then
echo "pre-push: $default advances only through a merged pull request" >&2
exit 1
fi
fi
done

exec ./scripts/task check
Loading