Repository navigation
ci(pre-commit): protect main and versions/ branches from direct commits - #54
Merged
Merged
Conversation
Adds the no-commit-to-branch hook from pre-commit-hooks, blocking direct commits to main and any versions/* branch. Runs on pre-commit.ci and locally via `pre-commit run`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The change is minimal, correctly configured for the existing pre-commit-hooks repo entry, and matches the stated PR intent without introducing code/runtime risk.
Pull request overview
This PR strengthens contributor workflow safeguards by adding a pre-commit hook that blocks direct commits to protected branches, aligning with the repository’s CI + local pre-commit usage.
Changes:
- Add
no-commit-to-branch(frompre-commit-hooks) to prevent committing directly tomain. - Extend branch protection to maintenance branches matching
versions/*via a regex pattern.
File summaries
| File | Description |
|---|---|
| .pre-commit-config.yaml | Adds no-commit-to-branch hook configured to protect main and versions/* branches from direct commits. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
always_run is already the hook's shipped default, but setting it explicitly documents that this hook intentionally ignores any files/exclude/types filtering (and would still allow --allow-empty commits through). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
no-commit-to-branch would otherwise fail every push to main once this merges: CI checks out a real local branch literally named `main` for push events, so the hook would always fire. It's a client-side guard for a human running `git commit`/`git push` locally (or via installed git hooks) -- not something a full "run every hook" CI invocation should re-evaluate after the fact. Skips it there via SKIP=no-commit-to-branch; the hook itself is untouched and still fully active locally. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…anch Appends no-commit-to-branch to any SKIP a developer already has set (e.g. via their shell) rather than overwriting it wholesale, matching the same fix applied in response to Copilot review feedback on GalacticDynamics/coordinax#885. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
With default_stages: [pre-commit, pre-push] set repo-wide, this hook would also run on pre-push. It checks the currently checked-out branch, not the ref being pushed, so a maintainer sitting on main and pushing a release tag (or anything else) would be blocked even though they aren't committing to main. Restricting to stages: [pre-commit] keeps the guard at the point it's meant for -- a local `git commit` -- without touching pre-push at all. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Addresses Copilot review feedback on GalacticDynamics/galax#847: the comment said "CI checks out the real main branch," but the skip applies unconditionally, including local `nox -s lint` runs -- which is correct (a CI-only skip would leave the same false failure for any local dev running the full suite while on `main`). Fixes the wording to match the actual, intended behavior instead of narrowing it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The archaeology (why pre-commit's nodeenv/pyyaml floors mattered, why --skip clobbers, the full CI-checkout explanation) belongs in commit history, not permanently inline. Keeps just enough to orient a future reader without re-litigating the whole investigation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
no-commit-to-branchhook from pre-commit-hooks to.pre-commit-config.yamlmain(--branch main) and anyversions/*maintenance branch (--pattern ^versions/.*) from direct commitspre-commit run) and on pre-commit.ciTest plan
argsshape against the same change already merged in unxt#929, coordinax#881, jaxmore#26, quaxed#213, quax-blocks#64🤖 Generated with Claude Code