A refused push and untracked files both pass silently #223

New Issue

Closed

opened 2026-09-10 04:13:33 -05:00 by null · 2 comments

null commented

2026-09-10 04:13:33 -05:00

Owner

Seen at a25077d (v0.9.5).

What is true now.

.githooks/post-commit pushes, and exits 0 even when the push is refused, so a commit looks published when it is not. pre-push refuses while any tracked file is modified, which makes this easy to hit.
.githooks/pre-commit builds the working tree, not the index, so an unstaged or untracked file can make a commit pass that cannot build on its own.
scripts/release.sh:211 checks only tracked changes, while docker build . (lines 328-331) packs the working tree. An image can work while its tagged commit cannot build.

What it costs. Work that exists only locally, and a release that cannot be rebuilt from its tag.

What to do. post-commit reports a failed push loudly. release.sh refuses to run while untracked, non-ignored files exist.

Verify: committing with an unrelated tracked file left modified (so pre-push refuses) prints a clear push-failure warning, and npm run release -- --dry-run refuses with an untracked file present and passes once it is removed.

Seen at a25077d (v0.9.5). **What is true now.** - `.githooks/post-commit` pushes, and exits 0 even when the push is refused, so a commit looks published when it is not. `pre-push` refuses while any tracked file is modified, which makes this easy to hit. - `.githooks/pre-commit` builds the working tree, not the index, so an unstaged or untracked file can make a commit pass that cannot build on its own. - `scripts/release.sh:211` checks only tracked changes, while `docker build .` (lines 328-331) packs the working tree. An image can work while its tagged commit cannot build. **What it costs.** Work that exists only locally, and a release that cannot be rebuilt from its tag. **What to do.** post-commit reports a failed push loudly. release.sh refuses to run while untracked, non-ignored files exist. Verify: committing with an unrelated tracked file left modified (so pre-push refuses) prints a clear push-failure warning, and `npm run release -- --dry-run` refuses with an untracked file present and passes once it is removed.

null added this to the Batch 18: Guards and landmines found building Batch 17 milestone 2026-09-10 04:13:33 -05:00

null added the

bug

infra

labels 2026-09-10 04:13:33 -05:00

null commented

2026-09-10 04:24:02 -05:00

Author

Owner

Correcting this issue's premise before anyone acts on it. Two of its three claims are wrong, observed live while committing 26136f4.

post-commit does not pass silently. With the push refused it printed:

post-commit: push was refused. The commit is safe locally and the branch is now ahead.

It exits 0, which is right (a commit cannot be undone from post-commit), and it says so plainly. No change needed.

pre-commit already warns when the guards ran against something other than the commit:

pre-commit: NOTE: unstaged changes are present. The guards ran against the working
            tree, so they did not verify this commit in isolation.

What is actually left, and it is narrower:

That note counts unstaged changes to tracked files only. An untracked file, such as a new module the staged code imports, makes the build pass while the commit alone cannot build, and nothing warns.
scripts/release.sh:211 checks only tracked changes, while docker build . packs the working tree. An image can work while its tagged commit cannot build. This is the half worth fixing.

Scope is now: count untracked files in the pre-commit note, and refuse a release while untracked, non-ignored files exist.

Verify: committing with an untracked file present prints a note naming it, and npm run release -- --dry-run refuses while one exists and passes once it is removed.

Correcting this issue's premise before anyone acts on it. Two of its three claims are wrong, observed live while committing 26136f4. **`post-commit` does not pass silently.** With the push refused it printed: ``` post-commit: push was refused. The commit is safe locally and the branch is now ahead. ``` It exits 0, which is right (a commit cannot be undone from post-commit), and it says so plainly. No change needed. **`pre-commit` already warns when the guards ran against something other than the commit:** ``` pre-commit: NOTE: unstaged changes are present. The guards ran against the working tree, so they did not verify this commit in isolation. ``` **What is actually left, and it is narrower:** 1. That note counts unstaged changes to tracked files only. An **untracked** file, such as a new module the staged code imports, makes the build pass while the commit alone cannot build, and nothing warns. 2. `scripts/release.sh:211` checks only tracked changes, while `docker build .` packs the working tree. An image can work while its tagged commit cannot build. This is the half worth fixing. Scope is now: count untracked files in the pre-commit note, and refuse a release while untracked, non-ignored files exist. Verify: committing with an untracked file present prints a note naming it, and `npm run release -- --dry-run` refuses while one exists and passes once it is removed.

null referenced this issue from a commit

2026-09-10 04:58:41 -05:00

fix(seo): the production sitemap had no dates, and the build context had secrets

null commented

2026-09-10 04:58:58 -05:00

Author

Owner

Partly fixed in 2f1e248, and partly wrong as filed. Two of the three claims were disproved live and corrected in the comment above: post-commit prints 'push was refused. The commit is safe locally and the branch is now ahead.', and pre-commit already warned when the guards ran against something other than the commit. What was real is fixed: scripts/release.sh now refuses while untracked, non-ignored files are present (docker build packs the working tree, so an untracked module produces an image that works and a tag that cannot rebuild it), and .githooks/pre-commit's note now counts untracked files as well as unstaged edits.

Partly fixed in 2f1e248, and partly wrong as filed. Two of the three claims were disproved live and corrected in the comment above: post-commit prints 'push was refused. The commit is safe locally and the branch is now ahead.', and pre-commit already warned when the guards ran against something other than the commit. What was real is fixed: scripts/release.sh now refuses while untracked, non-ignored files are present (docker build packs the working tree, so an untracked module produces an image that works and a tag that cannot rebuild it), and .githooks/pre-commit's note now counts untracked files as well as unstaged edits.

null closed this issue

2026-09-10 04:58:58 -05:00