Skip to content

feat(workflow): prevent direct git push and enhance bug-scanner anti-pattern detection - #132

Merged
NTCoding merged 5 commits into
mainfrom
issue-131-prevent-direct-git-push-and-up
Jan 11, 2026
Merged

NTCoding merged 5 commits into
mainfrom
issue-131-prevent-direct-git-push-and-up

Conversation

@NTCoding

@NTCoding NTCoding commented Jan 11, 2026 •

Copy link
Copy Markdown
Owner

User description

Closes #131

Summary

  • Block direct git push commands via hook to enforce /complete-task workflow
  • Reference anti-patterns.md in bug-scanner for comprehensive code quality checks

Changes

  1. Enhanced .claude/hooks/block-dangerous-commands.sh to reject git push commands and instruct agents to use /complete-task workflow
  2. Updated .claude/agents/bug-scanner.md to reference docs/conventions/anti-patterns.md in Priority 1 section

Test Plan

  • Verified hook blocks direct git push commands
  • Verified bug-scanner.md references anti-patterns.md
  • All tests pass
  • All lints pass

Fixes #131

🤖 Generated with Claude Code


PR Type

Enhancement


Description

  • Block direct git push commands to enforce /complete-task workflow

  • Add anti-patterns reference to bug-scanner Priority 1 section

  • Prevent orphaned, uncommitted changes after PR merge

  • Improve code quality checks with codebase-specific anti-pattern detection


Diagram Walkthrough

flowchart LR
  A["Agent attempts git push"] -->|blocked by hook| B["PreToolUse hook denies"]
  B -->|instructs user| C["Use /complete-task workflow"]
  C -->|runs complete pipeline| D["Lint, test, review, PR submit"]
  E["bug-scanner agent"] -->|references| F["anti-patterns.md"]
  F -->|detects| G["Codebase-specific anti-patterns"]
Loading

File Walkthrough

Relevant files
Enhancement
block-dangerous-commands.sh
Block direct git push commands via pre-tool hook                 

.claude/hooks/block-dangerous-commands.sh

  • Added new conditional block to detect and reject git push commands
  • Provides detailed error message instructing users to use
    /complete-task workflow
  • Explains that /complete-task runs complete verification pipeline and
    prevents orphaned changes
  • Fixed indentation consistency in existing conditional block
+13/-1   
bug-scanner.md
Add anti-patterns reference to bug-scanner priority section

.claude/agents/bug-scanner.md

  • Updated Priority 1 section header to include "Anti-Patterns"
  • Added instruction to review docs/conventions/anti-patterns.md for
    codebase-specific anti-patterns
  • Enhances bug-scanner to detect patterns beyond generic bugs
+3/-1     

Summary by CodeRabbit

  • Documentation

    • Clarified and expanded guidance on identifying anti-patterns and where to review codebase-specific conventions.
  • Chores

    • Strengthened safety guardrails to block risky direct push operations and improve pre-push checks.
    • Improved developer workflow messaging and automated push behavior when local branches are ahead of origin.

✏️ Tip: You can customize this high-level summary in your review settings.

NTCoding and others added 2 commits January 11, 2026 18:57
…ction

- Add git push blocking to prevent agents from bypassing /complete-task workflow
- Instructs users to use /complete-task for complete verification pipeline
- Add anti-patterns reference to bug-scanner Priority 1 section
- Prevents orphaned, uncommitted changes after PR merge

Co-Authored-By: Claude Haiku 4.5 <[email protected]>
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jan 11, 2026 •

Copy link
Copy Markdown

Deploying living-architecture with  Cloudflare Pages  Cloudflare Pages

Latest commit: a2253e9
Status: ✅  Deploy successful!
Preview URL: https://f10422ab.living-architecture.pages.dev
Branch Preview URL: https://issue-131-prevent-direct-git.living-architecture.pages.dev

View logs

@coderabbitai

coderabbitai Bot commented Jan 11, 2026 •

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Blocks direct git push via a new hook guard, adds a pre-push auto-push step in the PR submission script, and updates the bug-scanner docs to reference repository-specific anti-patterns for Priority 1 reviews.

Changes

Cohort / File(s) Change Summary
Workflow Guard
.claude/hooks/block-dangerous-commands.sh
Added a guard that rejects direct git push by returning a PreToolUse denial with rationale and exits before the auto-approve path; minor formatting tweak around the closing fi.
PR Submission Script
scripts/submit-pr.sh
Adjusted uncommitted-changes message; added a pre-push step that, if the branch is ahead of origin, runs git push -u origin "$BRANCH" before continuing with main-branch sync.
Documentation Update
.claude/agents/bug-scanner.md
Renamed Priority 1 heading to "Bug Patterns & Anti-Patterns" and added instruction to review docs/conventions/anti-patterns.md for codebase-specific anti-pattern detection.

Sequence Diagram(s)

sequenceDiagram
  participant Agent as Agent / Dev
  participant Local as Local Repo / Hooks
  participant Origin as Remote (origin)
  participant Submit as scripts/submit-pr.sh

  Agent->>Local: run `git push`
  Local->>Local: block-dangerous-commands.sh checks command
  alt direct push blocked
    Local-->>Agent: deny message -> "Use /complete-task"
  else allowed
    Local->>Origin: allow push
  end

  Note right of Agent: If using submit-pr.sh\nit may run pre-push auto-push step
  Agent->>Submit: run `scripts/submit-pr.sh`
  Submit->>Local: detect branch ahead -> `git push -u origin "$BRANCH"`
  Submit->>Local: continue main-branch sync logic
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Poem

🐰 I sniffed the repo, hopped with glee,

A push was blocked — not meant to be.
I nudged the docs, anti-patterns clear,
And pushed the branch the script held near.
Hop on, commit, then complete your task! ✨

🚥 Pre-merge checks | ✅ 3 | ❌ 1
❌ Failed checks (1 inconclusive)
Check name Status Explanation Resolution
Out of Scope Changes check ❓ Inconclusive Changes to submit-pr.sh introducing pre-push branch synchronization appear tangentially related but not directly required by issue #131 acceptance criteria. Clarify whether the submit-pr.sh changes are necessary for the complete-task workflow or represent scope creep outside issue #131 requirements.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes both main changes: preventing direct git push and enhancing bug-scanner anti-pattern detection, matching the primary objectives.
Linked Issues check ✅ Passed The PR implements all key requirements from #131: blocks direct git push with helpful messaging, updates bug-scanner to reference anti-patterns.md, and testing is completed.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings

Comment @coderabbitai help to get the list of available commands and usage tips.

@qodo-code-review

qodo-code-review Bot commented Jan 11, 2026 •

Copy link
Copy Markdown
Contributor

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🟡
🎫 #131
🟢 Update the hook script to reject git push commands and instruct the agent to use
/complete-task instead.
Update .claude/agents/bug-scanner.md to reference docs/conventions/anti-patterns.md in the
Priority 1 section.
Acceptance: `git push` is rejected by the hook with a helpful message.
Acceptance: `bug-scanner.md` references `anti-patterns.md`.
⚪ Verify the hook works by testing that commands are rejected as expected.
Acceptance: Agent workflow uses `/complete-task` instead of direct push.
Codebase Duplication Compliance
⚪
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

  • Update
Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-code-review

qodo-code-review Bot commented Jan 11, 2026 •

Copy link
Copy Markdown
Contributor

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
Possible issue
✅ Improve git push detection
Suggestion Impact:Updated the hook to use the suggested bash regex `[[ "$command" =~ ... ]]` instead of `grep -qE '^git push'`, improving detection robustness.

code diff:

-if echo "$command" | grep -qE '^git push'; then
+if [[ "$command" =~ (^|[[:space:]])git[[:space:]]+push($|[[:space:]]) ]]; then

Replace the grep command with a more robust bash regex match (=~) to accurately
detect git push commands while handling whitespace variations and using word
boundaries.

.claude/hooks/block-dangerous-commands.sh [18]

-if echo "$command" | grep -qE '^git push'; then
+if [[ "$command" =~ (^|[[:space:]])git[[:space:]]+push($|[[:space:]]) ]]; then

[Suggestion processed]

Suggestion importance[1-10]: 8

__

Why: This suggestion correctly identifies a potential bypass of the git push block and provides a more robust and efficient solution using bash built-ins, which is a critical improvement for this safety check.

Medium
  • Update

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In @.claude/hooks/block-dangerous-commands.sh:
- Around line 17-27: The current grep check uses the anchored pattern '^git
push' against the variable "command", which misses chained or prefixed
invocations; update the grep -qE pattern to search for git push anywhere using
word boundaries and required whitespace (e.g., use a regex like
'\bgit\s+push\b') so expressions such as "cd repo && git push" or "git fetch;
git push" are matched, replacing the existing '^git push' pattern in the block
that inspects "$command".
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4bd6a14 and c2fe835.

📒 Files selected for processing (2)
  • .claude/agents/bug-scanner.md
  • .claude/hooks/block-dangerous-commands.sh
🧰 Additional context used
🧠 Learnings (7)
📓 Common learnings
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Use scripts in `./scripts/` for git and GitHub operations (PRs, issues, tasks); do not use `gh` or `git` commands directly unless no script exists
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Do not use `--no-verify`, `--force`, or `--hard` flags in git operations; all commits must pass the verify gate

Applied to files:

  • .claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-06T18:13:55.588Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/reply-to-thread.sh:1-12
Timestamp: 2026-01-06T18:13:55.588Z
Learning: In shell scripts like reply-to-thread.sh, NTCoding prefers to keep code simple and not add explicit tool availability checks (e.g., for gh or jq) when the tools will fail immediately upon first use anyway, since such checks add code without changing behavior.

Applied to files:

  • .claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-07T08:54:48.071Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: docs/workflow/code-review.md:0-0
Timestamp: 2026-01-07T08:54:48.071Z
Learning: Applies to docs/workflow/**/*.sh : In shell scripts (.sh files), use `jq` for JSON construction instead of manual string escaping to properly handle backslashes, newlines, and tabs.

Applied to files:

  • .claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Avoid anti-patterns documented in `docs/conventions/anti-patterns.md`

Applied to files:

  • .claude/agents/bug-scanner.md
📚 Learning: 2026-01-07T08:54:48.071Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: docs/workflow/code-review.md:0-0
Timestamp: 2026-01-07T08:54:48.071Z
Learning: Applies to docs/workflow/**/*.{ts,tsx,js,jsx,!(**/*.test.ts,**/*.test.tsx,**/*.test.js,**/*.spec.ts,**/*.spec.tsx,**/*.spec.js)} : All production code must comply with anti-patterns guidelines defined in @/docs/conventions/anti-patterns.md. Violations are hard failures unless documented exceptions exist.

Applied to files:

  • .claude/agents/bug-scanner.md
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: When writing, editing, refactoring, or reviewing code, follow `docs/conventions/software-design.md`

Applied to files:

  • .claude/agents/bug-scanner.md
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Cloudflare Pages
🔇 Additional comments (2)
.claude/agents/bug-scanner.md (2)

20-20: LGTM - Clear heading update.

The heading accurately reflects the expanded scope to include anti-pattern detection.


22-22: LGTM - Achieves PR objective.

This addition successfully references the anti-patterns documentation as specified in issue #131. Based on learnings, this ensures bug-scanner checks will include documented anti-patterns.

Comment thread .claude/hooks/block-dangerous-commands.sh
NTCoding and others added 3 commits January 11, 2026 19:48
Use bash regex match with word boundaries to detect blocked git
operations anywhere in the command string, not just at the start.
This prevents bypass via command chaining like "cd repo && ..."

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Ensures commits are pushed before checking CI status, enabling
the /complete-task workflow to work with the hook that blocks
direct usage of certain git commands.

Co-Authored-By: Claude Opus 4.5 <[email protected]>
@sonarqubecloud

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In @scripts/submit-pr.sh:
- Around line 76-82: The script's direct git push call (the git push -u origin
"$BRANCH" inside the BRANCH/AHEAD block) will be blocked by the repo hooks;
replace that direct push with invoking the project's approved workflow command
(/complete-task) to perform the push and verification pipeline. Update the
BRANCH/AHEAD logic to detect when commits need to be published and call the
/complete-task command (passing branch and any required metadata) instead of
running git push so the .claude/hooks/block-dangerous-commands.sh and
.git/hooks/pre-push restrictions are respected.
📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c2fe835 and a2253e9.

📒 Files selected for processing (2)
  • .claude/hooks/block-dangerous-commands.sh
  • scripts/submit-pr.sh
🧰 Additional context used
🧠 Learnings (6)
📚 Learning: 2026-01-06T18:02:51.422Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/get-pr-feedback.sh:45-55
Timestamp: 2026-01-06T18:02:51.422Z
Learning: In shell scripts that call GraphQL APIs (e.g., scripts/get-pr-feedback.sh and similar), prefer using sed-based interpolation for GraphQL variables instead of gh api graphql's -f/-F flags. Rationale: sed-based interpolation is typically simpler and more robust in Bash contexts, avoids JSON encoding pitfalls, and keeps the script portable. Implement by building the GraphQL query as a string and substituting variables with sed or parameter expansion, ensuring proper escaping. If you must use -f/-F, provide clear justification in a comment.

Applied to files:

  • scripts/submit-pr.sh
📚 Learning: 2026-01-06T18:13:47.289Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/reply-to-thread.sh:1-12
Timestamp: 2026-01-06T18:13:47.289Z
Learning: In shell scripts across the repository (e.g., scripts/reply-to-thread.sh), keep the code simple by not adding explicit preflight tool-availability checks for external commands (like gh or jq) when those tools would fail on first use anyway. Such checks add boilerplate without changing behavior. If you must guard against missing tools, prefer a minimal, early startup check or rely on the script failing naturally at the point of use.

Applied to files:

  • scripts/submit-pr.sh
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Use scripts in `./scripts/` for git and GitHub operations (PRs, issues, tasks); do not use `gh` or `git` commands directly unless no script exists

Applied to files:

  • .claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Do not use `--no-verify`, `--force`, or `--hard` flags in git operations; all commits must pass the verify gate

Applied to files:

  • .claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-06T18:13:55.588Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/reply-to-thread.sh:1-12
Timestamp: 2026-01-06T18:13:55.588Z
Learning: In shell scripts like reply-to-thread.sh, NTCoding prefers to keep code simple and not add explicit tool availability checks (e.g., for gh or jq) when the tools will fail immediately upon first use anyway, since such checks add code without changing behavior.

Applied to files:

  • .claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-07T08:54:48.071Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: docs/workflow/code-review.md:0-0
Timestamp: 2026-01-07T08:54:48.071Z
Learning: Applies to docs/workflow/**/*.sh : In shell scripts (.sh files), use `jq` for JSON construction instead of manual string escaping to properly handle backslashes, newlines, and tabs.

Applied to files:

  • .claude/hooks/block-dangerous-commands.sh
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Cloudflare Pages
🔇 Additional comments (2)
scripts/submit-pr.sh (1)

71-71: LGTM!

Clearer, more actionable error message.

.claude/hooks/block-dangerous-commands.sh (1)

17-27: LGTM! The guard effectively blocks direct git push commands.

The regex pattern correctly matches git push with various argument combinations. The denial message clearly directs agents to the proper workflow.

One minor note: the pattern will also match strings like echo "git push", but this is acceptable since agents shouldn't need to echo git push commands in legitimate workflows.

Comment thread scripts/submit-pr.sh
@NTCoding
NTCoding merged commit 6f8b83c into main Jan 11, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Prevent direct git push and update bug-scanner anti-patterns

1 participant