chore(git): land the consolidated guard scripts - #223
Conversation
sovereign is canonical for scripts/git. These files had drifted into as many as
ten versions across the portfolio, and the correct behaviour was usually held by
the rarest one rather than by canonical, so canonical was fixed first and this
is the result being propagated.
What changes behaviourally:
guard-no-main-push reads the pre-push payload, so pushing main from a
feature branch is refused rather than silently allowed
guard-large-files measures the staged blob, not the working tree
guard-generated no longer refuses the removal of build output committed by
mistake, which was the one action its own message asked for
guard-branch accepts <type>/<slug>, codex/<type>/<slug> and peer-agent names,
and exempts dependabot and release-please branches
guard-atomic gains GIT_GUARD_ALLOW_LARGE_COMMIT=1 for a deliberate exception
guard-secrets keys its CI skip on CI being "true" rather than merely set
create-branch validates the type, bounds the slug, and resumes an existing
branch instead of failing
propose-commit-message takes scope from the staged paths and names the file
Adds scripts/git/tests: eight suites, where this repository had none.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 075892f61d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| typed_pattern='^(codex/)?(feat|fix|chore|refactor|docs|test|perf|ci|spike|hotfix)/[a-z0-9]+(-[a-z0-9]+)*$' | ||
| peer_pattern='^(codex|cc)/[a-z0-9]+(-[a-z0-9]+)+$' | ||
|
|
||
| in_ci() { [[ "${CI:-}" == "true" || "${GITHUB_ACTIONS:-}" == "true" ]]; } |
There was a problem hiding this comment.
When a developer or local tool exports CI=true, in_ci now returns success and the pre-commit guard permits staged work directly on main or master; the previous check required GitHub Actions as well. This defeats the repository's non-main implementation-work rule in a plausible local environment, so the protected-branch exemption should rely on a CI-specific signal rather than generic CI=true.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
| typed_pattern='^(codex/)?(feat|fix|chore|refactor|docs|test|perf|ci|spike|hotfix)/[a-z0-9]+(-[a-z0-9]+)*$' | ||
| peer_pattern='^(codex|cc)/[a-z0-9]+(-[a-z0-9]+)+$' |
There was a problem hiding this comment.
The new patterns accept branches such as fix/null-pointer and cc/rebuild-index, even though implementation branches in this repository are required to use codex/<type>/<slug>. Because this script is invoked by the pre-commit hook and the GitHub branch-name job, these alternatives now pass every automated branch check instead of enforcing the repository convention.
AGENTS.md reference: AGENTS.md:L13-L13
Useful? React with 👍 / 👎.
|
|
||
| if git diff --cached --name-only | grep -E "$forbidden" >/dev/null; then | ||
| # codex-os-managed | ||
| forbidden='(^|/)(node_modules|dist|build|out|coverage|\.next|target)/' |
There was a problem hiding this comment.
Removing playwright-report, test-results, and .lighthouseci from this expression means tracked changes or force-added output in those generated directories now pass the pre-commit guard. These are real output paths in this repository (they remain listed in .gitignore and the CI workflows), and the new deletion filter already allows cleanup without removing them from the forbidden set.
Useful? React with 👍 / 👎.
1 participant
Lands the consolidated
scripts/gitguard scripts, plus the eight test suitesthat come with them, onto this repository's default branch.
These files had drifted into as many as ten versions across the portfolio. The
correct behaviour turned out to live in the rarest variant rather than in the
canonical copy, every time, so canonical was fixed first and this is the result
being propagated.
What changes behaviourally:
guard-no-main-pushreads the pre-push payload, so pushing the default branchfrom a feature branch is refused rather than silently allowed
guard-large-filesmeasures the staged blob, not the working tree, so a filestaged large and shrunk afterwards no longer slips through
guard-generatedno longer refuses the removal of build output committed bymistake, which was the one action its own message asked for
guard-branchaccepts<type>/<slug>,codex/<type>/<slug>and peer-agentnames, and exempts dependabot and release-please branches
guard-atomicgainsGIT_GUARD_ALLOW_LARGE_COMMIT=1for a deliberate exceptionguard-secretskeys its CI skip onCIbeing"true"rather than merely set,which closes three unintended bypasses
create-branchvalidates the type, bounds the slug, and resumes an existingbranch instead of failing
propose-commit-messagetakes its scope from the staged pathsWhy this is a new branch. The same commit was already applied a first time,
but onto whatever feature branch each repository happened to have checked out.
In eleven repositories that branch's pull request had merged weeks earlier, so
the commit landed on top of a closed pull request and could never reach the
default branch through it. It has been cherry-picked here onto a branch that
starts from the current default branch. The original commits were left where
they are; nothing was rewritten or force-pushed.
Verified: all eight guard suites pass in this repository, run against this
branch.