chore: protect main (branch protection + local pre-push guard) - #14
Merged
Conversation
main is now protected server-side (GitHub branch protection: PR required, BugBot check, admins included, no force-push/deletion). This adds the local belt-and-braces: a tracked pre-push hook that rejects direct pushes to main before the round-trip, an installer that drops it into .git/hooks alongside graphify's hooks (no core.hooksPath hijack), and CLAUDE.md branching rules. Hooks pinned to LF so the shebang survives the Windows checkout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟢 Claude BugBot Analysis
No bugs found. This PR adds documentation (CLAUDE.md branching note), a .gitattributes rule enforcing LF line endings for hook scripts, and a local pre-push git hook plus installer script — the hook correctly reads the standard git pre-push stdin protocol (local_ref local_sha remote_ref remote_sha) and blocks pushes where remote_ref matches refs/heads/main, and the installer correctly copies and chmods the hook files.
No bugs were detected in this PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Feature work reached
mainvia a direct admin push. This closes that hole with two layers.Server-side (already applied to the repo)
GitHub branch protection on
main:Claude BugBot reviewLocal (this PR)
scripts/git-hooks/pre-push— rejects direct pushes tomainlocally, before the network round-trip, with a message pointing at the branch/PR flowscripts/install-git-hooks.sh— copies tracked hooks into.git/hookswithout hijackingcore.hooksPath, so graphify'spost-commit/post-checkoutkeep working; run once per cloneCLAUDE.md— mandatory branching section + the one-time install step.gitattributes— pins hooks (and*.sh) to LF so the shebang survives the Windows checkoutEmergency bypass is
git push --no-verify; the server rule still catches it.Verified
main→ blocked (exit 1); push to a feature branch → allowed (exit 0)i/lf w/lfin index and working tree🤖 Generated with Claude Code