commitguardian 0.1.1__tar.gz → 0.1.2__tar.gz

{commitguardian-0.1.1 → commitguardian-0.1.2}/CHANGELOG.md

@@ -6,6 +6,18 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-09-19
+
+### Fixed
+
+- `remediation.fix_on_push` did nothing for `git push origin HEAD` or
+  `git push origin HEAD:main`. For those forms Git reports the local ref as plain
+  `HEAD`, which the "only move local branches" guard did not recognise, so the
+  push was blocked instead of cleaned (safely - nothing was rewritten or sent).
+  `HEAD` is now resolved to the checked-out branch when that branch's tip is the
+  commit being pushed; a detached `HEAD` is still refused. Found by testing the
+  released 0.1.1 package on a real machine.
+
 ## [0.1.1] - 2026-09-19
 
 ### Added

{commitguardian-0.1.1 → commitguardian-0.1.2}/CITATION.cff

@@ -22,5 +22,5 @@ keywords:
   - ai-attribution
   - software-supply-chain
 license: MIT
-version: 0.1.1
+version: 0.1.2
 date-released: "2026-09-19"

{commitguardian-0.1.1 → commitguardian-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: commitguardian
-Version: 0.1.1
+Version: 0.1.2
 Summary: Block AI, bot and agent attribution in Git commits, locally and on GitHub.
 Project-URL: Homepage, https://github.com/oyinlola-tech/commitguard
 Project-URL: Repository, https://github.com/oyinlola-tech/commitguard

{commitguardian-0.1.1 → commitguardian-0.1.2}/docs/api/README.md

@@ -5,7 +5,7 @@ dashboard is built on it. It exposes repositories, scans, violations, policies
 and their governance, exceptions, audit events, notifications and GitHub
 installations. The same process also receives GitHub webhooks.
 
-> **Stability.** CommitGuard is pre-alpha (`0.1.1`, "Development Status :: 2
+> **Stability.** CommitGuard is pre-alpha (`0.1.2`, "Development Status :: 2
 > - Pre-Alpha"). The API is versioned `v1` in its path, but no compatibility
 > promise exists yet. Endpoints, fields and error codes can change between
 > commits. There is no OpenAPI document; these pages, the view models in

{commitguardian-0.1.1 → commitguardian-0.1.2}/docs/cli/doctor.md

@@ -60,7 +60,7 @@ commitguard doctor --json
 
 ```json
 {
-  "commitguard_version": "0.1.1",
+  "commitguard_version": "0.1.2",
   "status": "HEALTHY",
   "enforcement": "LOCAL ENFORCEMENT ONLY",
   "counts": {"PASS": 14, "INFO": 1, "NOT CONFIGURED": 2, "WARNING": 0, "FAIL": 0},

{commitguardian-0.1.1 → commitguardian-0.1.2}/docs/deployment/README.md

@@ -1,6 +1,6 @@
 # Deploying CommitGuard
 
-CommitGuard 0.1.1 is pre-alpha software. This section describes the ways it
+CommitGuard 0.1.2 is pre-alpha software. This section describes the ways it
 can be deployed today, what each way protects against, and what it does not.
 Every mode runs the same detection engine and policy evaluator; they differ in
 where the check runs, who controls it, and whether it can prevent a merge.

{commitguardian-0.1.1 → commitguardian-0.1.2}/docs/deployment/local.md

@@ -25,7 +25,7 @@ and `commitguard-cli` on PyPI are unrelated projects.)
 
 ```bash
 pipx install commitguardian
-commitguard --version        # commitguard 0.1.1
+commitguard --version        # commitguard 0.1.2
 
 # or pinned to an exact commit:
 pipx install "git+https://github.com/oyinlola-tech/commitguard@<commit-sha>"

{commitguardian-0.1.1 → commitguardian-0.1.2}/docs/deployment/production.md

@@ -1,6 +1,6 @@
 # Running the App service in production
 
-> Status: **Experimental.** CommitGuard is pre-alpha (0.1.1).
+> Status: **Experimental.** CommitGuard is pre-alpha (0.1.2).
 > No external production deployments have been recorded yet.
 > The App service and organization governance have been validated only by this
 > repository's test suites, against an offline model of GitHub. There are no

{commitguardian-0.1.1 → commitguardian-0.1.2}/docs/deployment/troubleshooting.md

@@ -30,7 +30,7 @@ repository. Uninstall it and install from source, pinned to a commit:
 ```bash
 python -m pip uninstall commitguard
 pipx install "git+https://github.com/oyinlola-tech/commitguard@<commit-sha>"
-commitguard --version      # commitguard 0.1.1
+commitguard --version      # commitguard 0.1.2
 ```
 
 **`the GitHub App needs the optional dependencies: pip install 'commitguard[app]'`**

{commitguardian-0.1.1 → commitguardian-0.1.2}/docs/maintainers/release-process.md

@@ -29,7 +29,7 @@ Artifacts are not signed, and no build provenance attestation is generated.
 | Runtime version (`commitguard --version`) | `src/commitguard/__init__.py`, `__version__` |
 | Dashboard package version | `web/package.json` (`"private": true`, not released separately; currently `0.1.0`, independent of the Python version) |
 
-Both Python locations must be changed together; today they both say `0.1.1`.
+Both Python locations must be changed together; today they both say `0.1.2`.
 `tests/integration/git/test_cli_commands.py` checks that `commitguard --version`
 prints `__version__`; no test compares it with `pyproject.toml`, so check both by
 hand. The name in `pyproject.toml` is pinned by

{commitguardian-0.1.1 → commitguardian-0.1.2}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "hatchling.build"
 # "commitguard-cli", belong to two unrelated projects (see docs/adr/009). The
 # import package and the console script stay `commitguard`.
 name = "commitguardian"
-version = "0.1.1"
+version = "0.1.2"
 description = "Block AI, bot and agent attribution in Git commits, locally and on GitHub."
 readme = "README.md"
 license = "MIT"

{commitguardian-0.1.1 → commitguardian-0.1.2}/src/commitguard/__init__.py

@@ -21,6 +21,6 @@ Package layout (dependency direction flows downwards only)::
     utils        -> subprocess / filesystem / platform helpers
 """
 
-__version__ = "0.1.1"
+__version__ = "0.1.2"
 
 __all__ = ["__version__"]

{commitguardian-0.1.1 → commitguardian-0.1.2}/src/commitguard/git/repository.py

@@ -425,6 +425,12 @@ class Repository:
             raise MalformedGitOutputError("git hash-object returned no object id")
         return sha
 
+    def current_branch(self) -> str | None:
+        """``refs/heads/<name>`` that ``HEAD`` points at, or None when detached."""
+        result = self._git(["symbolic-ref", "--quiet", "HEAD"], check=False)
+        ref = result.stdout.decode("utf-8", errors="replace").strip()
+        return ref if result.ok and ref.startswith("refs/heads/") else None
+
     def not_on_any_remote(self, shas: Sequence[str]) -> set[str]:
         """The subset of ``shas`` not reachable from any remote-tracking branch.
 

{commitguardian-0.1.1 → commitguardian-0.1.2}/src/commitguard/services/hooks.py

@@ -228,6 +228,22 @@ def plan_push(
     return plans, list(ordered)
 
 
+def _branch_ref(repository: Repository, update: PushUpdate) -> str:
+    """The local ref a push update really moves.
+
+    ``git push origin HEAD`` (and ``HEAD:main``) makes Git report the local ref
+    as plain ``HEAD``. It is the checked-out branch when ``HEAD`` points at one
+    whose tip is exactly the commit being pushed; otherwise it stays ``HEAD``,
+    which ``fix_on_push`` refuses to move (a detached ``HEAD`` is not a branch).
+    """
+    if update.local_ref != "HEAD":
+        return update.local_ref
+    branch = repository.current_branch()
+    if branch is not None and repository.ref_commit(branch) == update.local_oid:
+        return branch
+    return update.local_ref
+
+
 def run_pre_push(
     repository: Repository,
     remote: str,
@@ -256,7 +272,7 @@ def run_pre_push(
             analyzer,
             [
                 BranchUpdate(
-                    local_ref=plan.update.local_ref,
+                    local_ref=_branch_ref(repository, plan.update),
                     local_oid=plan.update.local_oid,
                     commits=plan.commits,
                 )

{commitguardian-0.1.1 → commitguardian-0.1.2}/tests/integration/hooks/test_pre_push.py

@@ -556,3 +556,28 @@ def test_doctor_reports_that_fix_on_push_is_on(fixing_repo) -> None:  # type: ig
         check=False,
     )
     assert "remediation.fix_on_push is on" in result.stdout
+
+
+@pytest.mark.parametrize("refspec", ["main", "HEAD", "HEAD:main"])
+def test_fix_on_push_works_for_every_way_of_naming_the_branch(fixing_repo, refspec: str) -> None:  # type: ignore[no-untyped-def]
+    """`git push origin HEAD` makes Git report the local ref as plain `HEAD`.
+
+    That form was refused on 0.1.1 because `HEAD` is not `refs/heads/...`: found
+    by testing the released package on a real machine, not by the suite.
+    """
+    fixing_repo.commit(AI)
+    result = push(fixing_repo, refspec)
+    assert result.returncode != 0
+    assert "CLEANED 1 unpushed commit" in result.stderr, result.stderr
+    assert "Claude" not in messages(fixing_repo)
+
+
+def test_fix_on_push_refuses_a_detached_head(fixing_repo) -> None:  # type: ignore[no-untyped-def]
+    """A detached HEAD is not a branch, so there is nothing safe to move."""
+    bad = fixing_repo.commit(AI)
+    fixing_repo.git("checkout", "--quiet", "--detach", bad)
+    result = push(fixing_repo, "HEAD:refs/heads/main")
+    assert result.returncode != 0
+    assert "PUSH BLOCKED" in result.stderr
+    assert "CLEANED" not in result.stderr
+    assert fixing_repo.head() == bad