Add protected-refs-policy with force-push blocking #58

Merged

vnprc merged 3 commits from agent/block-force-push into master

2026-06-22 20:10:28 +01:00

vnprc-agent commented

2026-06-22 19:43:07 +01:00

Contributor

Move the git hook policy engine from allod/secrets to tools. The script is a generic policy engine that reads config from ~/.config/git/ at runtime — no secrets in it. Config files stay in secrets.

New: detect non-fast-forward pushes via git merge-base --is-ancestor and block them on agent/* branches and active-pr-branches entries. Overridable with ALLOW_PROTECTED_REF=1.

The verbatim copy from secrets includes run_cdk_tracked_hook, which is hardcoded to $HOME/work/cdk and misc/git-hooks/pre-commit. This doesn't belong in a generic tool but removing it here would mix concerns. #60 tracks replacing it with a generic .hookspath convention that works with external projects without requiring them to change their layout.

Follow-up: vnprc/secrets#36 to update home-agent-hooks.nix to source the script from tools and delete the old copy.

Ref: vnprc/parking-lot#35

Validation

bash tests/protected-refs-policy.sh

Move the git hook policy engine from allod/secrets to tools. The script is a generic policy engine that reads config from ~/.config/git/ at runtime — no secrets in it. Config files stay in secrets. New: detect non-fast-forward pushes via `git merge-base --is-ancestor` and block them on `agent/*` branches and `active-pr-branches` entries. Overridable with `ALLOW_PROTECTED_REF=1`. The verbatim copy from secrets includes `run_cdk_tracked_hook`, which is hardcoded to `$HOME/work/cdk` and `misc/git-hooks/pre-commit`. This doesn't belong in a generic tool but removing it here would mix concerns. [#60](https://forge.anarch.diy/Allod/tools/issues/60) tracks replacing it with a generic `.hookspath` convention that works with external projects without requiring them to change their layout. Follow-up: [vnprc/secrets#36](https://forge.anarch.diy/vnprc/secrets/issues/36) to update `home-agent-hooks.nix` to source the script from tools and delete the old copy. Ref: https://forge.anarch.diy/vnprc/parking-lot/issues/35 ## Validation ``` bash tests/protected-refs-policy.sh ```

vnprc-agent added 1 commit

2026-06-22 19:43:07 +01:00

Add protected-refs-policy with force-push blocking 5784570a95

Move the git hook policy engine from allod/secrets to tools. The script
is a generic policy engine that reads config from ~/.config/git/ at
runtime — no secrets in it. Config files stay in secrets.

New in this version: detect non-fast-forward pushes via git merge-base
and block them on agent/* branches and active-pr-branches entries.
Overridable with ALLOW_PROTECTED_REF=1 when rebase is genuinely needed.

Test suite rewritten to match tools conventions: numbered assertions
with descriptions, file-based counter for subshell safety, self-contained
fixture data.

Ref: parking-lot#35

vnprc-agent force-pushed agent/block-force-push from 5784570a95 to 1d47c25194

2026-06-22 19:49:18 +01:00

Compare

vnprc-agent added 1 commit

2026-06-22 20:04:06 +01:00

Use generic repo names in tests, drop cdk-specific hook test 5c515d7847

Replace work/cdk and work/hashpool with work/test-repo and
work/other-repo. Tests should exercise generic policy behavior,
not be coupled to specific repo paths.

Drop the run_cdk_tracked_hook test — that's cdk-specific behavior
that will be replaced by a generic .hookspath convention (issue #60).