blob: f6e04eca0d7f3d2394467eb539e72c3267e2d82a [file] [log] [blame]
Stefan Tauner76347082016-11-27 17:45:49 +01001#!/bin/sh
2
3# A hook script to verify what is about to be pushed. Called by "git
4# push" after it has checked the remote status, but before anything has been
5# pushed. If this script exits with a non-zero status nothing will be pushed.
6#
7# This hook is called with the following parameters:
8#
9# $1 -- Name of the remote to which the push is being done
10# $2 -- URL to which the push is being done
11#
12# If pushing without using a named remote those arguments will be equal.
13#
14# Information about the commits which are being pushed is supplied as lines to
15# the standard input in the form:
16#
17# <local ref> <local sha1> <remote ref> <remote sha1>
18
19remote="$1"
20url="$2"
21
22zero=0000000000000000000000000000000000000000
23
Nico Huberc3b02dc2023-08-12 01:13:45 +020024upstream_pattern="github\.com.flashprog/flashprog(\.git)?|flashprog\.org.git/flashprog(\.git)?"
Stefan Tauner76347082016-11-27 17:45:49 +010025
Stefan Tauner63bf2222017-10-04 03:12:09 +020026# Only care about the upstream repositories
Stefan Tauner76347082016-11-27 17:45:49 +010027if echo "$url" | grep -q -v -E "$upstream_pattern" ; then
28 exit 0
29fi
30
31while read local_ref local_sha remote_ref remote_sha ; do
Stefan Tauner63bf2222017-10-04 03:12:09 +020032
33 # Only allow the stable and staging branches as well as versioned stable branches (e.g., 0.0.x).
34 # The matching expression's RE is always anchored to the first character (^ is undefined).
35 # The outer parentheses are needed to print out the whole matched string.
36 version=$(expr ${remote_ref#*refs/heads/} : '\(\([0-9]\+\.\)\{2,\}x\)$')
37 if [ "$remote_ref" != "refs/heads/staging" ] && \
38 [ "$remote_ref" != "refs/heads/stable" ] && \
39 [ -z "$version" ]; then
Stefan Tauner76347082016-11-27 17:45:49 +010040 echo "Feature branches not allowed ($remote_ref)." >&2
41 exit 1
42 fi
43
44 if [ "$local_sha" = $zero ]; then
45 echo "Deletion of branches is prohibited." >&2
46 exit 1
47 fi
48
Stefan Tauner76347082016-11-27 17:45:49 +010049 # Check for Signed-off-by and Acked-by
50 commit=$(git rev-list -n 1 --all-match --invert-grep -E \
Stefan Tauner63bf2222017-10-04 03:12:09 +020051 --grep '^Signed-off-by: .+ <.+@.+\..+>$' \
52 --grep '^Acked-by: .+ <.+@.+\..+>$' \
Stefan Tauner76347082016-11-27 17:45:49 +010053 "$remote_sha..$local_sha")
54 if [ -n "$commit" ]; then
55 echo "Commit $local_sha in $local_ref is missing either \"Signed-off-by\"" \
56 " or \"Acked-by\" lines, not pushing." >&2
57 exit 1
58 fi
59
Stefan Tauner63bf2222017-10-04 03:12:09 +020060 # Make _really_ sure we do not rewrite history of any head/branch
61 if [ "${remote_ref#*refs/heads/}" != "$remote_ref" ]; then
62 nonreachable=$(git rev-list $remote_sha ^$local_sha | head -1)
63 if [ -n "$nonreachable" ]; then
64 echo "Only fast-forward pushes are allowed on branches." >&2
65 echo "At least $nonreachable is not included in $remote_sha while pushing to " \
66 "$remote_ref" >&2
67 exit 1
Stefan Tauner76347082016-11-27 17:45:49 +010068 fi
Stefan Tauner63bf2222017-10-04 03:12:09 +020069 fi
Stefan Tauner76347082016-11-27 17:45:49 +010070
71 # FIXME: check commit log format (subject without full stop at the end etc).
72 # FIXME: do buildbot checks if authorized?
73done
74
75exit 0