Repository navigation
feat(workflow): prevent direct git push and enhance bug-scanner anti-pattern detection - #132
Conversation
…ction - Add git push blocking to prevent agents from bypassing /complete-task workflow - Instructs users to use /complete-task for complete verification pipeline - Add anti-patterns reference to bug-scanner Priority 1 section - Prevents orphaned, uncommitted changes after PR merge Co-Authored-By: Claude Haiku 4.5 <[email protected]>
…ect-git-push-and-up
Deploying living-architecture with
|
| Latest commit: |
a2253e9
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://f10422ab.living-architecture.pages.dev |
| Branch Preview URL: | https://issue-131-prevent-direct-git.living-architecture.pages.dev |
📝 WalkthroughWalkthroughBlocks direct Changes
Sequence Diagram(s)sequenceDiagram
participant Agent as Agent / Dev
participant Local as Local Repo / Hooks
participant Origin as Remote (origin)
participant Submit as scripts/submit-pr.sh
Agent->>Local: run `git push`
Local->>Local: block-dangerous-commands.sh checks command
alt direct push blocked
Local-->>Agent: deny message -> "Use /complete-task"
else allowed
Local->>Origin: allow push
end
Note right of Agent: If using submit-pr.sh\nit may run pre-push auto-push step
Agent->>Submit: run `scripts/submit-pr.sh`
Submit->>Local: detect branch ahead -> `git push -u origin "$BRANCH"`
Submit->>Local: continue main-branch sync logic
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
PR Compliance Guide 🔍Below is a summary of compliance checks for this PR:
Compliance status legend🟢 - Fully Compliant🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label |
|||||||||||||||||||||||||||||||
PR Code Suggestions ✨Explore these optional code suggestions:
|
|||||||||
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.claude/hooks/block-dangerous-commands.sh:
- Around line 17-27: The current grep check uses the anchored pattern '^git
push' against the variable "command", which misses chained or prefixed
invocations; update the grep -qE pattern to search for git push anywhere using
word boundaries and required whitespace (e.g., use a regex like
'\bgit\s+push\b') so expressions such as "cd repo && git push" or "git fetch;
git push" are matched, replacing the existing '^git push' pattern in the block
that inspects "$command".
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (2)
.claude/agents/bug-scanner.md.claude/hooks/block-dangerous-commands.sh
🧰 Additional context used
🧠 Learnings (7)
📓 Common learnings
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Use scripts in `./scripts/` for git and GitHub operations (PRs, issues, tasks); do not use `gh` or `git` commands directly unless no script exists
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Do not use `--no-verify`, `--force`, or `--hard` flags in git operations; all commits must pass the verify gate
Applied to files:
.claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-06T18:13:55.588Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/reply-to-thread.sh:1-12
Timestamp: 2026-01-06T18:13:55.588Z
Learning: In shell scripts like reply-to-thread.sh, NTCoding prefers to keep code simple and not add explicit tool availability checks (e.g., for gh or jq) when the tools will fail immediately upon first use anyway, since such checks add code without changing behavior.
Applied to files:
.claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-07T08:54:48.071Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: docs/workflow/code-review.md:0-0
Timestamp: 2026-01-07T08:54:48.071Z
Learning: Applies to docs/workflow/**/*.sh : In shell scripts (.sh files), use `jq` for JSON construction instead of manual string escaping to properly handle backslashes, newlines, and tabs.
Applied to files:
.claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Avoid anti-patterns documented in `docs/conventions/anti-patterns.md`
Applied to files:
.claude/agents/bug-scanner.md
📚 Learning: 2026-01-07T08:54:48.071Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: docs/workflow/code-review.md:0-0
Timestamp: 2026-01-07T08:54:48.071Z
Learning: Applies to docs/workflow/**/*.{ts,tsx,js,jsx,!(**/*.test.ts,**/*.test.tsx,**/*.test.js,**/*.spec.ts,**/*.spec.tsx,**/*.spec.js)} : All production code must comply with anti-patterns guidelines defined in @/docs/conventions/anti-patterns.md. Violations are hard failures unless documented exceptions exist.
Applied to files:
.claude/agents/bug-scanner.md
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: When writing, editing, refactoring, or reviewing code, follow `docs/conventions/software-design.md`
Applied to files:
.claude/agents/bug-scanner.md
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cloudflare Pages
🔇 Additional comments (2)
.claude/agents/bug-scanner.md (2)
20-20: LGTM - Clear heading update.The heading accurately reflects the expanded scope to include anti-pattern detection.
22-22: LGTM - Achieves PR objective.This addition successfully references the anti-patterns documentation as specified in issue #131. Based on learnings, this ensures bug-scanner checks will include documented anti-patterns.
Use bash regex match with word boundaries to detect blocked git operations anywhere in the command string, not just at the start. This prevents bypass via command chaining like "cd repo && ..." Co-Authored-By: Claude Opus 4.5 <[email protected]>
Ensures commits are pushed before checking CI status, enabling the /complete-task workflow to work with the hook that blocks direct usage of certain git commands. Co-Authored-By: Claude Opus 4.5 <[email protected]>
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @scripts/submit-pr.sh:
- Around line 76-82: The script's direct git push call (the git push -u origin
"$BRANCH" inside the BRANCH/AHEAD block) will be blocked by the repo hooks;
replace that direct push with invoking the project's approved workflow command
(/complete-task) to perform the push and verification pipeline. Update the
BRANCH/AHEAD logic to detect when commits need to be published and call the
/complete-task command (passing branch and any required metadata) instead of
running git push so the .claude/hooks/block-dangerous-commands.sh and
.git/hooks/pre-push restrictions are respected.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (2)
.claude/hooks/block-dangerous-commands.shscripts/submit-pr.sh
🧰 Additional context used
🧠 Learnings (6)
📚 Learning: 2026-01-06T18:02:51.422Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/get-pr-feedback.sh:45-55
Timestamp: 2026-01-06T18:02:51.422Z
Learning: In shell scripts that call GraphQL APIs (e.g., scripts/get-pr-feedback.sh and similar), prefer using sed-based interpolation for GraphQL variables instead of gh api graphql's -f/-F flags. Rationale: sed-based interpolation is typically simpler and more robust in Bash contexts, avoids JSON encoding pitfalls, and keeps the script portable. Implement by building the GraphQL query as a string and substituting variables with sed or parameter expansion, ensuring proper escaping. If you must use -f/-F, provide clear justification in a comment.
Applied to files:
scripts/submit-pr.sh
📚 Learning: 2026-01-06T18:13:47.289Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/reply-to-thread.sh:1-12
Timestamp: 2026-01-06T18:13:47.289Z
Learning: In shell scripts across the repository (e.g., scripts/reply-to-thread.sh), keep the code simple by not adding explicit preflight tool-availability checks for external commands (like gh or jq) when those tools would fail on first use anyway. Such checks add boilerplate without changing behavior. If you must guard against missing tools, prefer a minimal, early startup check or rely on the script failing naturally at the point of use.
Applied to files:
scripts/submit-pr.sh
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Use scripts in `./scripts/` for git and GitHub operations (PRs, issues, tasks); do not use `gh` or `git` commands directly unless no script exists
Applied to files:
.claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-10T10:14:57.499Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-10T10:14:57.499Z
Learning: Do not use `--no-verify`, `--force`, or `--hard` flags in git operations; all commits must pass the verify gate
Applied to files:
.claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-06T18:13:55.588Z
Learnt from: NTCoding
Repo: NTCoding/living-architecture PR: 58
File: scripts/reply-to-thread.sh:1-12
Timestamp: 2026-01-06T18:13:55.588Z
Learning: In shell scripts like reply-to-thread.sh, NTCoding prefers to keep code simple and not add explicit tool availability checks (e.g., for gh or jq) when the tools will fail immediately upon first use anyway, since such checks add code without changing behavior.
Applied to files:
.claude/hooks/block-dangerous-commands.sh
📚 Learning: 2026-01-07T08:54:48.071Z
Learnt from: CR
Repo: NTCoding/living-architecture PR: 0
File: docs/workflow/code-review.md:0-0
Timestamp: 2026-01-07T08:54:48.071Z
Learning: Applies to docs/workflow/**/*.sh : In shell scripts (.sh files), use `jq` for JSON construction instead of manual string escaping to properly handle backslashes, newlines, and tabs.
Applied to files:
.claude/hooks/block-dangerous-commands.sh
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Cloudflare Pages
🔇 Additional comments (2)
scripts/submit-pr.sh (1)
71-71: LGTM!Clearer, more actionable error message.
.claude/hooks/block-dangerous-commands.sh (1)
17-27: LGTM! The guard effectively blocks directgit pushcommands.The regex pattern correctly matches
git pushwith various argument combinations. The denial message clearly directs agents to the proper workflow.One minor note: the pattern will also match strings like
echo "git push", but this is acceptable since agents shouldn't need to echo git push commands in legitimate workflows.



User description
Closes #131
Summary
git pushcommands via hook to enforce /complete-task workflowChanges
.claude/hooks/block-dangerous-commands.shto rejectgit pushcommands and instruct agents to use /complete-task workflow.claude/agents/bug-scanner.mdto referencedocs/conventions/anti-patterns.mdin Priority 1 sectionTest Plan
Fixes #131
🤖 Generated with Claude Code
PR Type
Enhancement
Description
Block direct
git pushcommands to enforce/complete-taskworkflowAdd anti-patterns reference to bug-scanner Priority 1 section
Prevent orphaned, uncommitted changes after PR merge
Improve code quality checks with codebase-specific anti-pattern detection
Diagram Walkthrough
File Walkthrough
block-dangerous-commands.sh
Block direct git push commands via pre-tool hook.claude/hooks/block-dangerous-commands.sh
git pushcommands/complete-taskworkflow/complete-taskruns complete verification pipeline andprevents orphaned changes
bug-scanner.md
Add anti-patterns reference to bug-scanner priority section.claude/agents/bug-scanner.md
docs/conventions/anti-patterns.mdforcodebase-specific anti-patterns
Summary by CodeRabbit
Documentation
Chores
✏️ Tip: You can customize this high-level summary in your review settings.