Server Git Hooks

pre-receive.sh

#!/bin/bash

# todo: single commit? CI stuff?

while read old_commit new_commit ref
do
  if [ "$old_commit" == "0000000000000000000000000000000000000000" ]; then
    range=$new_commit
  else
    range=$old_commit..$new_commit
    
    if [ "$ref" == "refs/heads/main" ] && ! git merge-base --is-ancestor "$ref" "$new_commit"; then
      echo "$ref is a protected branch"
      exit 1
    fi
  fi
  
  if [[ $(git rev-list --merges $range) ]]; then
    echo "$ref contains merge commits; please rebase"
    exit 1
  fi

  if ! git rev-list $range | xargs git verify-commit; then
    echo "$ref has unsigned commits in range $range; please sign your commits"
    exit 1
  fi
done