Merge ~rodrigo-zaiden/ubuntu-cve-tracker:git-hooks into ubuntu-cve-tracker:master

[Rodrigo Figueiredo Zaiden]

Suggestion of a new git hook:
prevent us from forcing a push to the main branch.

 $ git push --force
 FORCE pushing to MASTER is blocked
 If you know what you are doing and need to ignore this, use:
   git push --force --no-verify
 error: failed to push some refs to '<repo>'

also adding it to the Makefile so it can be installed with
 make dev_setup

[Steve Beattie (sbeattie)]

Thanks, this is a clever way to approach this. However, I have gone ahead and corrected the permissions on the master branch in launchpad https://code.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+permissions to block force pushes.

(If it turns out we need to do a force push to remove something from the repo, we can adjust the permissions temporarily to do so.)

review: Disapprove

Unmerged commits

294bc2d... by Rodrigo Figueiredo Zaiden on 2023-01-26

add pre-push hook and install with make dev_setup

 the pre-push hook will prevent the usage of --force when
 pushing a commit.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

diff --git a/Makefile b/Makefile
index 2c0abb7..c0d24af 100644
--- a/Makefile
+++ b/Makefile
@@ -58,6 +58,9 @@ dev_setup:
 		install -m 755 -b -S .backup scripts/git-hooks/pre-commit-pyflakes3 .git/hooks ; \
 		echo install -m 755 -b -S .backup scripts/git-hooks/pre-commit-emacs .git/hooks ; \
 		install -m 755 -b -S .backup scripts/git-hooks/pre-commit-emacs .git/hooks ; \
+		# install git push hook in UCT repo \
+		echo install -m 755 -b -S .backup scripts/git-hooks/pre-push .git/hooks ; \
+		install -m 755 -b -S .backup scripts/git-hooks/pre-push .git/hooks ; \
 		# install git prepare message hook; this is used to do a \
 		# check-syntax run for merge commits, which the regular git \
 		# commit hook mind-bogglingly does not get run on \
diff --git a/scripts/git-hooks/pre-push b/scripts/git-hooks/pre-push
new file mode 100755
index 0000000..4cfbde4
--- /dev/null
+++ b/scripts/git-hooks/pre-push
@@ -0,0 +1,18 @@
+#!/bin/bash
+#
+# This hook will prevent 'git push' with '--force' argument
+# To enable this hook, place it in .git/hooks/pre-push.
+
+PROTECTED_BRANCH='master'
+CURRENT_BRANCH=$(git symbolic-ref HEAD | sed -e 's,.*/\(.*\),\1,')
+
+COMMAND=$(ps -ocommand= -p $PPID)
+FILTER='--force'
+
+if [[ $PROTECTED_BRANCH == $CURRENT_BRANCH ]] &&
+   [[ "$COMMAND" =~ .*"$FILTER".* ]]; then
+    echo -e "\e[1;31mFORCE pushing to MASTER is blocked \e[0m"
+    echo -e "\e[1;33mIf you know what you are doing and need to ignore this, use: \e[0m"
+    echo -e "\e[1;33m  $COMMAND --no-verify \e[0m"
+    exit 1
+fi