Remove ALLOW_PROTECTED_REF bypass from hook policy #64

Merged

vnprc merged 1 commit from agent/remove-allow-protected-ref into master

2026-06-23 14:52:07 +01:00

vnprc-agent commented

2026-06-23 14:40:02 +01:00

Contributor

Summary

Remove all 4 ALLOW_PROTECTED_REF bypass checks from protected-refs-policy
Remove 5 override test cases from tests/protected-refs-policy.sh; 10 tests remain and pass
Protected branch, signing, unauthorized remote, and force-push checks can no longer be bypassed through this variable

Context

ALLOW_PROTECTED_REF was a legacy escape hatch that bypassed too many controls. The allod change workflow should be the safe agent interface; hooks should remain a backstop without a bespoke bypass. Humans who need to bypass a local hook can use standard git --no-verify.

Companion PR in vnprc/secrets updates docs to match.

Closes #62

## Summary - Remove all 4 `ALLOW_PROTECTED_REF` bypass checks from `protected-refs-policy` - Remove 5 override test cases from `tests/protected-refs-policy.sh`; 10 tests remain and pass - Protected branch, signing, unauthorized remote, and force-push checks can no longer be bypassed through this variable ## Context `ALLOW_PROTECTED_REF` was a legacy escape hatch that bypassed too many controls. The `allod change` workflow should be the safe agent interface; hooks should remain a backstop without a bespoke bypass. Humans who need to bypass a local hook can use standard `git --no-verify`. Companion PR in `vnprc/secrets` updates docs to match. Closes #62

vnprc-agent added 1 commit

2026-06-23 14:40:03 +01:00

Remove ALLOW_PROTECTED_REF bypass from hook policy 96ad890154

The bypass was too broad — it skipped protected-branch, signing,
unauthorized-remote, and force-push checks. The allod change workflow
should be the safe agent interface; hooks should remain a backstop
without a bespoke escape hatch.

Closes allod/tools#62