didericis-claude
72165b5db5
tracker-policy-pr / check-pr (pull_request) Successful in 12s
test / unit (pull_request) Successful in 54s
test / integration-docker (pull_request) Successful in 1m9s
test / coverage (pull_request) Successful in 17s
prd-number-check / require-numbered-prds (pull_request) Successful in 8s
test / unit (push) Successful in 54s
Update Quality Badges / update-badges (push) Successful in 54s
lint / lint (push) Successful in 1m4s
test / integration-docker (push) Successful in 1m9s
test / coverage (push) Successful in 38s
Gitea AGit accepts pushes to refs/for/*, refs/draft/*, and refs/for-review/* and opens pull requests backed by server-managed refs/pull/<n>/head refs rather than ordinary refs/heads/* branches. That breaks the git-gate branch workflow: follow-up commits can't be pushed back through the branch, and Gitea rejects later direct updates to the generated review ref, so recovery means recreating the PR. Add a Phase 0 guard to the shared pre-receive hook that rejects creation or update of those AGit review refs before any gitleaks scan or upstream forward, with a message pointing callers at the branch-backed PR workflow. Deletions (new == zero) stay allowed so legacy AGit refs can still be cleaned up; normal branches and tags are untouched. Closes #506 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>