didericis/bot-bottle
1
0
Fork 0
Code Issues 34 Pull Requests 11 Actions Packages Releases Wiki Activity

fix(git-gate): reject AGit review refs in pre-receive
tracker-policy-pr / check-pr (pull_request) Successful in 12s
Details
test / unit (pull_request) Successful in 54s
Details
test / integration-docker (pull_request) Successful in 1m9s
Details
test / coverage (pull_request) Successful in 17s
Details
prd-number-check / require-numbered-prds (pull_request) Successful in 8s
Details
test / unit (push) Successful in 54s
Details
Update Quality Badges / update-badges (push) Successful in 54s
Details
lint / lint (push) Successful in 1m4s
Details
test / integration-docker (push) Successful in 1m9s
Details
test / coverage (push) Successful in 38s
Details

Browse Source 
Gitea AGit accepts pushes to refs/for/*, refs/draft/*, and
refs/for-review/* and opens pull requests backed by server-managed
refs/pull/<n>/head refs rather than ordinary refs/heads/* branches.
That breaks the git-gate branch workflow: follow-up commits can't be
pushed back through the branch, and Gitea rejects later direct updates
to the generated review ref, so recovery means recreating the PR.

Add a Phase 0 guard to the shared pre-receive hook that rejects
creation or update of those AGit review refs before any gitleaks scan
or upstream forward, with a message pointing callers at the
branch-backed PR workflow. Deletions (new == zero) stay allowed so
legacy AGit refs can still be cleaned up; normal branches and tags are
untouched.

Closes #506

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit was merged in pull request #509.
This commit is contained in:
didericis (claude)
2026-07-26 17:59:21 +00:00
parent 0edd46d56d
commit 72165b5db5
2 changed files with 90 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bot_bottle/gateway/git_gate/render.py
+21
View File
@@ -252,6 +252,27 @@ cat > "$refs_file"
zero=0000000000000000000000000000000000000000
# Phase 0: reject Gitea AGit review refs before scanning or forwarding.
# A push to refs/for/*, refs/draft/*, or refs/for-review/* asks Gitea to
# open a pull request backed by a server-managed refs/pull/<n>/head rather
# than an ordinary refs/heads/* branch. That breaks the git-gate workflow:
# follow-up commits can't be pushed back through the branch, and Gitea
# rejects later direct updates to the generated review ref. Fail the whole
# push here (before any gitleaks scan or upstream forward) so the caller
# pushes a real branch and opens the PR against it instead. Deletions
# (new == zero) stay allowed so stale AGit refs can still be cleaned up.
while IFS=' ' read -r old new ref; do
[ -z "$ref" ] && continue
[ "$new" = "$zero" ] && continue
case "$ref" in
refs/for/*|refs/draft/*|refs/for-review/*)
echo "git-gate: refusing AGit review ref $ref" >&2
echo "git-gate: push to refs/heads/<branch> and open a branch-backed pull request instead" >&2
exit 1
;;
esac
done < "$refs_file"
supervise_gitleaks_allow() {
log_opts=$1
ref=$2