Repository navigation
fix(hooks): verify clean checked-out push revisions - #326
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 48181fa541
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Pre-push checked working files instead of the commits Git was sending. An unstaged fix could hide a broken outgoing commit, and pushing another branch checked unrelated source. The hook now captures Git’s complete ref updates, rejects any nondeleted update that is not the exact clean checked-out
HEAD, and verifies that immutable commit in a private directory. All updates are preflighted before tests execute; multiple refs and commit tags pointing toHEADare supported, and deletion-only pushes skip source checks.Ordinary tests, race tests, pinned lint and module tidiness consume the captured module/configuration. Caller files and staging remain untouched. A fresh private index forces working-content comparison without trusting stale size/mtime metadata while preserving Git checkout conversions. Final HEAD and cleanliness checks reject concurrent checkout changes. Shared bootstrap input ownership, replacement-disabled reads and sanitized Git/Go context prevent source substitution. Cancellation lets admitted tests finish their own cleanup before failing the push and skipping later gates.
Validation covers actual pushes and destination objects; harmless initializer canaries for unattached, mixed, patched and hidden-index code; stale-stat regressions; accepted clean/CRLF controls; all four independently failing gates; real pinned lint; actual-hook cancellation and retained independent child-group cleanup; full ordinary/race suites; formatting/build/vet/lint/tidiness; and 100,195 generated protocol cases. Controlled real-tool push measurements cover one/five aliases of checked-out HEAD, 10/1,000 embedded files and 0/100 supporting commits. The full SDK also passes the four gates through its enabled pre-push hook.
The checked-out source and tooling remain trusted; hooks do not isolate hostile code or certify every historical commit. Cancellation can wait for active compilation/tests. Nix delegation has stub coverage; actual Nix evaluation was not run.
Closes #251