From cf2c19206fe9c3196fb996c8da863cf0061f5f98 Mon Sep 17 00:00:00 2001 From: nstarman Date: Tue, 15 Sep 2026 10:23:33 -0400 Subject: [PATCH 1/2] ci(pre-commit): protect main and versions/ branches from direct commits Adds the no-commit-to-branch hook from pre-commit-hooks, blocking direct commits to main and any versions/* branch. Runs on pre-commit.ci and locally via `pre-commit run`. Co-Authored-By: Claude Sonnet 5 --- .pre-commit-config.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 83fa953..d874ba9 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -25,6 +25,8 @@ repos: - id: mixed-line-ending - id: name-tests-test args: ["--pytest-test-first"] + - id: no-commit-to-branch + args: ["--branch", "main", "--pattern", "^versions/.*"] - id: requirements-txt-fixer - id: trailing-whitespace From 03a574a3b272bf36851db8384deeeee06367a0eb Mon Sep 17 00:00:00 2001 From: nstarman Date: Tue, 15 Sep 2026 10:33:15 -0400 Subject: [PATCH 2/2] ci: explicitly set always_run: true on no-commit-to-branch always_run is already the hook's shipped default, but setting it explicitly documents that this hook intentionally ignores any files/exclude/types filtering (and would still allow --allow-empty commits through). Co-Authored-By: Claude Sonnet 5 --- .pre-commit-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index d874ba9..5768bdd 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -27,6 +27,7 @@ repos: args: ["--pytest-test-first"] - id: no-commit-to-branch args: ["--branch", "main", "--pattern", "^versions/.*"] + always_run: true - id: requirements-txt-fixer - id: trailing-whitespace