git: guard this repo's commits against a stray work identity - #17
Merged
Merged
Conversation
Adds pre-commit, pre-merge-commit, and pre-push hooks that refuse any committer address outside a hard-coded two-address allowlist: the personal identity and the one Claude Code web sessions commit under. ./install wires them up by pointing this clone's core.hooksPath at git/hooks (a relative path resolves against the repo root), so the guard is repo-local -- no other repo on the machine is affected. The check is on the committer, not the author: the committer is whoever is running git right now, which is the identity that leaks, while the author is provenance worth preserving when amending or rebasing someone else's work. pre-push is a backstop for commits that never saw pre-commit -- rebase, cherry-pick, --no-verify, or predating the hooks. All of it is bypassable by design; enforcement that cannot be bypassed has to live on the remote.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
pre-commit,pre-merge-commit, andpre-pushhooks undergit/hooks/that refuse any committer address outside a hard-coded two-address allowlist:krishna0bala@proton.meandnoreply@anthropic.com(the identity Claude Code web sessions commit under, so those keep working). The goal is to keep a work identity from ever committing to or pushing this repo.Design
./installrunsgit config core.hooksPath git/hooksin this clone (a relativecore.hooksPathresolves against the repo root, verified from subdirectories too). No global config is touched and no other repo on the machine is affected.pre-pushbackstop. Catches commits that never sawpre-commit(rebase, cherry-pick,--no-verify, commits predating the hooks) by scanning exactly the commits the push would add (git log <tips> --not --remotes). Branch deletions push no commits and are skipped.identity-guard.shwith no config escape hatch; the repo is public, so nothing private should ever be written there. Matching is case-insensitive.All of this is local, best-effort protection:
--no-verifyandgit -c core.hooksPath=bypass it by design. Enforcement that cannot be bypassed has to live on the remote.Testing
Exercised in a sandboxed clone: work identity blocked at commit, amend, and merge; both allowed identities pass (case-insensitively, from subdirectories too); a
--no-verify-smuggled work commit is blocked at push and passes after--amend --reset-author; branch deletion pushes pass; an unrelated repo on the same machine is unaffected. The hooks are also active in the clone that produced this PR and ran on its own commit.🤖 Generated with Claude Code
https://claude.ai/code/session_01FRUvdR8pcw238epFLCc7X9
Generated by Claude Code