Repository navigation
Describe the Write Guard's Prune, Mirror, heads/, and Push-Target Readings - #3042
Merged
Merged
Conversation
…dings The agent-safety READMEs now state how the push check reads --prune, --mirror, a heads/ destination, and a bare push's full push-target name, and that a bare push is denied when git cannot list the remotes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Name prune among the push options read as git reads them, split the heads/ completion sentence, and state that a remote name is stripped only where a slash follows it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The sentence after the remote-name strip now names the text after refs/remotes/ rather than a pronoun that reads as the stripped name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
A recorded local strict-review pass covers head |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
Documentation changes are consistent and have no unresolved review issues.
0 open findings
What changed in this PR
Updates both agent-safety READMEs to document the write guard’s current push-target parsing behavior.
Changes:
- Documents
--prune,--mirror, andheads/handling. - Documents
@{push}remote resolution and failure behavior.
| File | Summary |
|---|---|
host-setup/agent-safety/README.md |
Updates requirement 4 push-reading documentation. |
host-setup/agent-safety/claude/README.md |
Mirrors the updated write-guard behavior. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #3042 +/- ##
========================================
Coverage 61.00% 61.00%
========================================
Files 17 17
Lines 9014 9014
========================================
Hits 5499 5499
Misses 3515 3515
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ptr727
added a commit
that referenced
this pull request
Oct 15, 2026
… Narrative Findings, and Bootstrap Handoff Tests to Main (#3051) - #3042 brings the agent-safety READMEs up to the write guard's #3023 and #3037 readings: `--prune` beside a pattern, `:`, `--all`, or a bare push, a `--mirror` push with no refspec, a `heads/` destination outside `refs/`, the full `@{push}` read, and a bare push denied when `git remote` cannot list the remotes - #3041 has `backlog-burndown` keep an abandoned group's claim comment until cleanup decides its release, say stopped on each path that sends a group to the maintainer, and name a branch no pull request has used when a claim comment first names it - #3044 tests `bootstrap.sh`'s `--report` handoff to the agent tools step, tests the `--agents` handoff on Linux and through `Invoke-AgentsInstall` under `pwsh`, and moves the unprivileged-root probe into `tests/host_capability.py` - #3045 makes `pr_review.py` read an `Open findings remain:` list in a Copilot review and count each entry no thread of the round accounts for, pairing by severity tier and file, so the count can only rise - #3049 makes `gh-write-guard` read a bare push's destination from `push.default` and `branch.<name>.merge`, read a persisted `remote.<name>.mirror`, deny when the `@{push}` read times out or cannot run, give a dash-named word after `--` or `--end-of-options` a reading as a remote or refspec, and judge a push moved into another checkout against that checkout's origin as well. A differential against the previous guard found no deny-to-allow flip. It addresses one item of #2943, which stays open - #3054 makes `gh-write-guard` answer unresolved, and so deny, when its `push.default` read times out or cannot run, a promotion fix for this pull request's first review - #3062 brings both agent-safety READMEs up to #3054: an unset `push.default` is read as `simple`, both destinations are read for a value git does not define or a read exiting with any other error, and a read that times out or cannot run is denied - #3059 bumps `actions/create-github-app-token` from 3.2.0 to 3.3.0 After this merges, the host-safety installer payload changes, so the maintainer runs the installer after promotion. Fixes #3021 Fixes #3026 Fixes #3027 Fixes #3039 Fixes #3033 Fixes #3038 Fixes #3034 Fixes #3031 Fixes #3019 Fixes #3020 Fixes #3029 Fixes #3036 Fixes #3052 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The agent-safety READMEs now describe the push readings the write guard performs since the earlier write-guard changes, and nothing beyond them. Both files change only inside the requirement 4 push-reading text.
--prunejoins the push options read as git reads them. Beside a refspec pattern that can match underrefs/heads/, a lone:refspec,--all, or a bare push, a--pruneis read as deleting every branch protected by default.--mirrorpush with no refspec is read as forcing and deleting every branch protected by default.refs/that startsheads/, such asHEAD:heads/developor:heads/develop, is read as the branch afterheads/as well as by its literal name.@{push}reading: a listed remote name is stripped with its/where it leads the text afterrefs/remotes/, and that text is also checked whole and with its first segment dropped.git remotecannot list the remotes.Each reading was confirmed against
_push_targets,_dst_branches,_push_ref_branches,_read_branch, and_check_push_bypassat develop's tip, and by a scratch probe calling_push_targetson constructed commands.Local review
Three recorded
local-strict-reviewpasses. The first raised a wording imprecision on the remote-name strip and three new sentences over 25 words, all fixed. The second raised an ambiguous "That text" referent, fixed. The third raised nothing. The one remaining--check sentence-lengthhit in the root README is the unchanged "A force-push and a delete each write the branch too" sentence, reflowed onto a changed line, so it is pre-existing rather than introduced.Closes on promotion: #3021
🤖 Generated with Claude Code