Module publish_guard 

Put gh-agent’s publish guard in front of every git push an agent makes.

gh-agent writes a git hooks directory whose pre-push scans what a push to a public repository would publish and refuses it on a hit; the other hooks in it run the repository’s own hook of that name. Git only uses it if core.hooksPath points there, and a repository’s own core.hooksPath (this repo sets .githooks) beats a global one. Configuration from the environment (GIT_CONFIG_COUNT, GIT_CONFIG_KEY_<n>, GIT_CONFIG_VALUE_<n>) beats both, so that is how agents get it.

The directory is computed the way gh-agent hooks-path computes it, from the agent’s own env first and then this process’s, rather than by running gh-agent on every spawn. It is only used once gh-agent has written it (any gh-agent 0.5+ run as git’s credential helper does); an agent started before that gets it at its next start. Without it the spawn goes ahead unchanged: the guard is an extra check, never a reason to fail.

Like GH_CONFIG_DIR from backend::gh_guard, the entry is reserved: a value for core.hooksPath already in the env is replaced, not kept.

Constants

COUNT 🔒

HOOKS_PATH_KEY 🔒

MARKER 🔒

The line gh-agent writes into every hook it generates.

MAX_ENTRIES 🔒

Larger counts already in the env are not trusted (and not looped over).

META_KEY_PTYSHELL_GIT_HOOKS_PATH

Block meta on an agent’s PtyShell: the hooks directory, which the PTY spawn sets through GIT_CONFIG_* (blockcontroller::shell::lifecycle). A PTY shell’s env is built from its own block, not from the agent’s, so the setting travels on that block, as gh_guard’s directory does.

Functions

apply_publish_guard

apply_publish_guard_in with the hooks directory this spawn’s env and this host give. Not called under test (see gh_guard::apply_gh_guard), so tests never read the host’s real hooks.

apply_publish_guard_in

Point core.hooksPath at hooks_dir in env, an overlay on process.

env_var 🔒

key from env; on Windows, where variable names ignore case, in any casing.

gh_agent_hooks_dir

Where gh-agent writes its hooks: GH_AGENT_HOOKS_DIR, else %LOCALAPPDATA%\gh-agent-hooks on Windows and $XDG_DATA_HOME/gh-agent/hooks (default ~/.local/share) elsewhere.

git_config_entries

The variables that set key = value on top of the GIT_CONFIG_* entries get already sees. Every slot that names key (case-insensitively, as git does for the section and name) gets the value, since git uses the last one it finds; with none, a slot is appended.

hooks_dir_for

The hooks directory for a spawn whose own env is env (falling back to process for anything it doesn’t set), if gh-agent has written it.

is_guard_hooks_dir

Whether dir holds hooks gh-agent wrote.

parse_count 🔒

without_hooks_path

env without its core.hooksPath entries, the others renumbered: for a container, where the host’s hooks directory means nothing, but any other GIT_CONFIG_* setting the agent’s env carries must still work.