Server-Side Hooks

#!/bin/sh
#
# pre-receive: Block force pushes to main and master.
#

while read OLD_SHA NEW_SHA REF; do
  BRANCH=$(echo "$REF" | sed -e 's|^refs/heads/||')

  # Only apply to main/master.
  if [ "$BRANCH" = "main" ] || [ "$BRANCH" = "master" ]; then
    # A force push has a non-zero OLD_SHA and a different NEW_SHA.
    if [ "$OLD_SHA" != "0000000000000000000000000000000000000000" ]; then
      # Check if the push is a fast-forward.
      git merge-base --is-ancestor "$OLD_SHA" "$NEW_SHA" 2>/dev/null
      if [ $? -ne 0 ]; then
        echo ""
        echo "❌ Force push to $BRANCH is not allowed."
        echo "   Create a new commit instead."
        echo ""
        exit 1
      fi
    fi
  fi
done

exit 0

#!/bin/sh
#
# update: Require Signed-Off-By in every commit.
#

REF=$1
OLD_SHA=$2
NEW_SHA=$3

# Only apply to branches.
echo "$REF" | grep -qE '^refs/heads/' || exit 0

# Find commits that are new in this push.
NEW_COMMITS=$(git rev-list "$OLD_SHA".."$NEW_SHA" 2>/dev/null)

for COMMIT in $NEW_COMMITS; do
  if ! git log -1 --format='%B' "$COMMIT" | grep -q 'Signed-off-by:'; then
    echo ""
    echo "❌ Commit $COMMIT is missing a Signed-off-by line."
    echo "   Use 'git commit -s' to add one."
    echo ""
    exit 1
  fi
done

exit 0

#!/bin/sh
#
# post-receive: Deploy to staging on push to main, notify Slack.
#

while read OLD_SHA NEW_SHA REF; do
  BRANCH=$(echo "$REF" | sed -e 's|^refs/heads/||')

  # Deploy on push to main.
  if [ "$BRANCH" = "main" ]; then
    echo "🚀 Deploying $NEW_SHA to staging..."

    # Run deployment script (e.g., CI trigger, rsync, Docker build).
    /opt/deploy/staging.sh "$NEW_SHA" "$BRANCH"

    # Send Slack notification.
    curl -s -X POST "$SLACK_WEBHOOK_URL" \
      -H 'Content-Type: application/json' \
      -d "{
        \"text\": \"🚀 Deployed $(echo $NEW_SHA | cut -c1-7) to staging\"
      }" > /dev/null 2>&1
  fi

  # Notify on any push.
  echo "[post-receive] $REF updated: $(echo $OLD_SHA | cut -c1-7) -> $(echo $NEW_SHA | cut -c1-7)"
done

#!/bin/sh
#
# pre-receive: Enforce multiple push policies.
#

HAS_ERROR=0

reject() {
  echo "❌ $1" >&2
  HAS_ERROR=1
}

while read OLD_SHA NEW_SHA REF; do
  BRANCH=$(echo "$REF" | sed -e 's|^refs/heads/||')
  echo "Checking: $BRANCH"

  # --- Policy 1: Block force pushes to main/master ---
  if [ "$BRANCH" = "main" ] || [ "$BRANCH" = "master" ]; then
    if [ "$OLD_SHA" != "0000000000000000000000000000000000000000" ]; then
      git merge-base --is-ancestor "$OLD_SHA" "$NEW_SHA" 2>/dev/null
      if [ $? -ne 0 ]; then
        reject "Force push to $BRANCH is not allowed."
      fi
    fi
  fi

  # --- Policy 2: Scan new commits for secrets ---
  NEW_COMMITS=$(git rev-list "$OLD_SHA".."$NEW_SHA" 2>/dev/null)
  for COMMIT in $NEW_COMMITS; do
    DIFF=$(git diff-tree -p "$COMMIT" 2>/dev/null)
    if echo "$DIFF" | grep -qE '(AKIA[0-9A-Z]{16}|sk_live_[a-zA-Z0-9]+|-----BEGIN (RSA )?PRIVATE KEY-----)'; then
      reject "Potential secret found in commit $(echo $COMMIT | cut -c1-7)."
    fi

    # --- Policy 3: Require Signed-off-by ---
    if ! git log -1 --format='%B' "$COMMIT" | grep -q 'Signed-off-by:'; then
      reject "Commit $(echo $COMMIT | cut -c1-7) is missing Signed-off-by."
    fi
  done
done

if [ $HAS_ERROR -eq 1 ]; then
  echo "" >&2
  echo "Push rejected. Fix the above issues and try again." >&2
  exit 1
fi

echo "✅ All policies passed."
exit 0