chore(git): land the consolidated guard scripts - #68
Conversation
sovereign is canonical for scripts/git. These files had drifted into as many as
ten versions across the portfolio, and the correct behaviour was usually held by
the rarest one rather than by canonical, so canonical was fixed first and this
is the result being propagated.
What changes behaviourally:
guard-no-main-push reads the pre-push payload, so pushing main from a
feature branch is refused rather than silently allowed
guard-large-files measures the staged blob, not the working tree, so a file
staged large and shrunk afterwards no longer slips through
guard-generated no longer refuses the removal of build output committed by
mistake, which was the one action its own message asked for
guard-branch accepts <type>/<slug>, codex/<type>/<slug> and peer-agent names,
and exempts dependabot and release-please branches
guard-atomic gains GIT_GUARD_ALLOW_LARGE_COMMIT=1 for a deliberate exception
guard-secrets keys its CI skip on CI being "true" rather than merely set
create-branch validates the type, bounds the slug, and resumes an existing
branch instead of failing
propose-commit-message takes scope from the staged paths and names the file
Adds scripts/git/tests: eight suites, where this repository had none.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a56f180675
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| typed_pattern='^(codex/)?(feat|fix|chore|refactor|docs|test|perf|ci|spike|hotfix)/[a-z0-9]+(-[a-z0-9]+)*$' | ||
| peer_pattern='^(codex|cc)/[a-z0-9]+(-[a-z0-9]+)+$' |
There was a problem hiding this comment.
When a developer uses either newly accepted form, such as fix/foo or cc/rebuild-index, this guard allows commits, but the branch-name job in .github/workflows/git-hygiene.yml lines 29-41 still accepts only codex/<type>/<slug>. Every PR from these branches will therefore fail the repository's branch-name check despite passing the local guard; update the workflow pattern alongside this expansion or retain the stricter local pattern.
Useful? React with 👍 / 👎.
1 participant
Lands the consolidated
scripts/gitguard scripts, plus the eight test suitesthat come with them, onto this repository's default branch.
These files had drifted into as many as ten versions across the portfolio. The
correct behaviour turned out to live in the rarest variant rather than in the
canonical copy, every time, so canonical was fixed first and this is the result
being propagated.
What changes behaviourally:
guard-no-main-pushreads the pre-push payload, so pushing the default branchfrom a feature branch is refused rather than silently allowed
guard-large-filesmeasures the staged blob, not the working tree, so a filestaged large and shrunk afterwards no longer slips through
guard-generatedno longer refuses the removal of build output committed bymistake, which was the one action its own message asked for
guard-branchaccepts<type>/<slug>,codex/<type>/<slug>and peer-agentnames, and exempts dependabot and release-please branches
guard-atomicgainsGIT_GUARD_ALLOW_LARGE_COMMIT=1for a deliberate exceptionguard-secretskeys its CI skip onCIbeing"true"rather than merely set,which closes three unintended bypasses
create-branchvalidates the type, bounds the slug, and resumes an existingbranch instead of failing
propose-commit-messagetakes its scope from the staged pathsWhy this is a new branch. The same commit was already applied a first time,
but onto whatever feature branch each repository happened to have checked out.
In eleven repositories that branch's pull request had merged weeks earlier, so
the commit landed on top of a closed pull request and could never reach the
default branch through it. It has been cherry-picked here onto a branch that
starts from the current default branch. The original commits were left where
they are; nothing was rewritten or force-pushed.
Verified: all eight guard suites pass in this repository, run against this
branch.