no-yolo-commits 1.2.0 → 1.3.0

package/README.md

@@ -17,6 +17,10 @@ One command. On every commit from now on:
 2. **An AI actually reads your diff** (via the [`claude`](https://claude.com/claude-code) CLI) and blocks the commit — but only for real, high-confidence problems. Not vibes, not "you could refactor this." If the reviewer is missing, slow, or having a bad day, it fails **open** — a flaky reviewer should never be the reason your commit is stuck. Skipped automatically when everything staged is a lockfile or generated asset, so bumping `package-lock.json` doesn't cost you a 2-minute wait.
 3. **`main`/`master` become look-but-don't-touch.** Commit straight there and instead of yelling at you, it just makes you a branch — `ACME-1788716508-fix-the-thing-you-were-actually-fixing`, ready to go, commit already on it. It even wrote the branch name from your diff.
 
+And on every `git push`:
+
+4. **Pushing to `main`/`master` is refused, full stop** — independent of #3 above. The auto-branch step only stops a *direct commit* from landing on a protected branch; nothing stops you from merging that branch back locally and pushing anyway a minute later, which lands you in exactly the state #3 was trying to prevent. This hook checks the actual destination of the push itself — merged, rebased, cherry-picked, doesn't matter, only where it's headed — so protection doesn't quietly evaporate the moment you (or an agent working on your behalf) does the merge-and-push in one motion without a real pause in between.
+
 No dashboard. No config file to argue with. No runtime dependencies — it's shell scripts wearing a [husky](https://typicode.github.io/husky/) trenchcoat.
 
 ## Install
@@ -29,7 +33,7 @@ That's the whole install, per project. It will, in order:
 
 - add `husky` as a devDependency (if you don't have it)
 - set `"scripts.prepare": "husky"` in `package.json`
-- drop `.husky/pre-commit` into your repo
+- drop `.husky/pre-commit` and `.husky/pre-push` into your repo
 
 ### Or install it once, everywhere
 
@@ -89,7 +93,8 @@ Same secret scan, same AI review, run against the PR's diff against its base bra
 This is a guardrail, not a cage. Bad day, emergency hotfix, you know exactly what you're doing:
 
 ```bash
-git commit --no-verify
+git commit --no-verify   # skip the secret scan / AI review / auto-branch for one commit
+git push --no-verify     # skip the protected-branch push check for one push
 ```
 
 No questions asked. No shame either — that's what it's there for.

package/bin/cli.js

@@ -39,7 +39,7 @@ function parseArgs(argv) {
 }
 
 function printHelp() {
-  console.log(`no-yolo-commits — an AI pre-commit reviewer + "no direct commits to main" guard
+  console.log(`no-yolo-commits — an AI pre-commit reviewer + "no direct commits or pushes to main" guard
 
 Usage:
   npx no-yolo-commits init [options]          per-project install (via husky)
@@ -57,7 +57,7 @@ Options:
                       reviewer, e.g. --stack="Next.js + TypeScript + Postgres"
                       (default: "TypeScript")
   --protect=a,b,c     Comma-separated branch names that block direct commits
-                      (default: "main,master")
+                      *and* pushes (default: "main,master")
   --model=NAME        Pass --model NAME through to every \`claude\` invocation
                       (cost/speed control — e.g. --model=haiku)
   --global, -g        Install into git's global hook template
@@ -108,6 +108,11 @@ function buildHookScript(args, defaultPrefixSource) {
   return { hookScript, prefix, protectedBranches };
 }
 
+function buildPrePushScript(protectedBranches) {
+  const templatePath = path.join(__dirname, '..', 'templates', 'pre-push.sh');
+  return fs.readFileSync(templatePath, 'utf8').replace(/__PROTECTED__/g, protectedBranches);
+}
+
 function run(cmd, cmdArgs) {
   console.log(`  $ ${cmd} ${cmdArgs.join(' ')}`);
   const result = spawnSync(cmd, cmdArgs, { cwd: CWD, stdio: 'inherit' });
@@ -128,9 +133,11 @@ function initProject(args) {
 
   const huskyDir = path.join(CWD, '.husky');
   const hookPath = path.join(huskyDir, 'pre-commit');
+  const pushHookPath = path.join(huskyDir, 'pre-push');
 
-  if (fs.existsSync(hookPath) && !args.force) {
-    fail(`${hookPath} already exists — pass --force to overwrite it.`);
+  if (!args.force) {
+    if (fs.existsSync(hookPath)) fail(`${hookPath} already exists — pass --force to overwrite it.`);
+    if (fs.existsSync(pushHookPath)) fail(`${pushHookPath} already exists — pass --force to overwrite it.`);
   }
 
   const hasHusky = (pkg.devDependencies && pkg.devDependencies.husky) || (pkg.dependencies && pkg.dependencies.husky);
@@ -153,12 +160,16 @@ function initProject(args) {
   run('npx', ['husky']);
 
   const { hookScript, prefix, protectedBranches } = buildHookScript(args, freshPkg.name);
+  const pushHookScript = buildPrePushScript(protectedBranches);
 
   fs.mkdirSync(huskyDir, { recursive: true });
   fs.writeFileSync(hookPath, hookScript);
   fs.chmodSync(hookPath, 0o755);
+  fs.writeFileSync(pushHookPath, pushHookScript);
+  fs.chmodSync(pushHookPath, 0o755);
 
   console.log(`✓ wrote ${path.relative(CWD, hookPath)}`);
+  console.log(`✓ wrote ${path.relative(CWD, pushHookPath)}`);
   printSummary(prefix, protectedBranches);
 }
 
@@ -171,17 +182,23 @@ function initGlobal(args) {
 
   const hooksDir = path.join(templateDir, 'hooks');
   const hookPath = path.join(hooksDir, 'pre-commit');
+  const pushHookPath = path.join(hooksDir, 'pre-push');
 
-  if (fs.existsSync(hookPath) && !args.force) {
-    fail(`${hookPath} already exists — pass --force to overwrite it.`);
+  if (!args.force) {
+    if (fs.existsSync(hookPath)) fail(`${hookPath} already exists — pass --force to overwrite it.`);
+    if (fs.existsSync(pushHookPath)) fail(`${pushHookPath} already exists — pass --force to overwrite it.`);
   }
 
   const { hookScript, prefix, protectedBranches } = buildHookScript(args, null);
+  const pushHookScript = buildPrePushScript(protectedBranches);
 
   fs.mkdirSync(hooksDir, { recursive: true });
   fs.writeFileSync(hookPath, hookScript);
   fs.chmodSync(hookPath, 0o755);
+  fs.writeFileSync(pushHookPath, pushHookScript);
+  fs.chmodSync(pushHookPath, 0o755);
   console.log(`✓ wrote ${hookPath}`);
+  console.log(`✓ wrote ${pushHookPath}`);
 
   run('git', ['config', '--global', 'init.templateDir', templateDir]);
 
@@ -201,7 +218,12 @@ function printSummary(prefix, protectedBranches) {
   console.log('  - AI review of staged changes (needs `claude` on PATH) — blocks only on high-confidence issues');
   console.log(`  - direct commits to [${protectedBranches}] auto-branch instead, as ${prefix}-<timestamp>-<slug>`);
   console.log('');
+  console.log('And on `git push`:');
+  console.log(`  - pushing to [${protectedBranches}] is refused outright — merged, rebased, whatever got`);
+  console.log('    a commit there locally doesn\'t matter, only where the push is headed');
+  console.log('');
   console.log('Bypass for one commit: git commit --no-verify');
+  console.log('Bypass for one push:   git push --no-verify');
 }
 
 function init(args) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "no-yolo-commits",
-  "version": "1.2.0",
-  "description": "AI pre-commit review (via the claude CLI) + a guard that auto-branches you off main/master instead of letting a direct commit land there.",
+  "version": "1.3.0",
+  "description": "AI pre-commit review (via the claude CLI) + a guard that auto-branches you off main/master instead of letting a direct commit land there, and a pre-push hook that refuses any push to main/master outright regardless of how it got there locally.",
   "keywords": [
     "husky",
     "git-hooks",
@@ -21,7 +21,7 @@
     "url": "https://github.com/ataztech910/no-yolo-commits/issues"
   },
   "bin": {
-    "no-yolo-commits": "./bin/cli.js"
+    "no-yolo-commits": "bin/cli.js"
   },
   "files": [
     "bin",

package/templates/pre-commit.sh

@@ -11,10 +11,10 @@ if ! git diff --cached --quiet 2>/dev/null; then
     -e '-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----' \
     -e 'AKIA[0-9A-Z]{16}' \
     -e 'xox[baprs]-[0-9A-Za-z-]{10,}' \
-    -e '(api[_-]?key|secret|access[_-]?token|password|passwd)["'"'"']?[[:space:]]*[:=][[:space:]]*["'"'"'][A-Za-z0-9_/+=-]{16,}["'"'"']' \
+    -e '(api[_-]?key|secret|token|password|passwd)["'"'"']?[[:space:]]*[:=][[:space:]]*["'"'"'][A-Za-z0-9_/+=:-]{16,}["'"'"']' \
     2>/dev/null || true)"
 
-  env_files="$(git diff --cached --name-only -- . 2>/dev/null | grep -E '(^|/)\.env(\.[^.]+)?$' | grep -v -E '\.(example|sample|template|dist)$' || true)"
+  env_files="$(git diff --cached --name-only -- . 2>/dev/null | grep -E '(^|/)\.env(\.[^.]+)?$|(^|/)[A-Za-z0-9_-]+\.env(\.[^.]+)?$' | grep -v -E '\.(example|sample|template|dist)$' || true)"
 
   if [ -n "$secret_hits" ] || [ -n "$env_files" ]; then
     echo ""

package/templates/pre-push.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env sh
+
+# --- Refuse pushes that land on a protected branch ---
+# git feeds this hook one line per ref being pushed on stdin:
+#   <local ref> <local sha1> <remote ref> <remote sha1>
+# The auto-branch step in pre-commit only pauses a direct commit to main/master — it says nothing
+# about what happens next. Fast-forward merge that branch locally and push, and the commit lands
+# on the protected branch exactly as if pre-commit had never stepped in. This hook closes that gap
+# by checking the actual destination of the push itself, independent of how the commit got there
+# locally (direct commit that somehow slipped through, merge, rebase, whatever) — merged or not
+# doesn't matter, only where it's headed.
+#
+# Deliberately blocks unconditionally rather than trying to special-case "but this one was already
+# reviewed" — that judgment call is exactly what a human decides by reaching for --no-verify, not
+# something a hook can infer from the ref list.
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ -z "$remote_ref" ] && continue
+  remote_branch="${remote_ref#refs/heads/}"
+  case " __PROTECTED__ " in
+    *" $remote_branch "*)
+      echo ""
+      echo "⛔ Push to '$remote_branch' blocked."
+      echo "   This repo doesn't push straight to a protected branch as a side effect of"
+      echo "   merging or committing locally — that has to be a deliberate, visible step."
+      echo ""
+      echo "   Push your branch instead (git push origin \$(git branch --show-current)) and"
+      echo "   open a PR, or if you really do mean to push here directly:"
+      echo "   git push --no-verify"
+      echo ""
+      exit 1
+      ;;
+  esac
+done
+
+exit 0