always all: pre-push hook runs the whole suite, refuses red - #59
Merged
Merged
Conversation
Marsita, 2026-09-19: "'always all' is simpler :) (as opposed to deciding what to run)". GitHub Actions already runs everything after the push and main now requires the `tests` and `audit` checks green to merge a PR. This is the same gate one step earlier, on the machine: 66 s on Gaia, 14 s on the NUC, and a red commit never leaves. First real run, against the live checkout, blocked a push on a failure that turned out to be someone's uncommitted work-in-progress; the same test passes on clean main. That is the hook doing its job. Escape hatch stays visible: `git push --no-verify`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmAXMHTsfEdyB4H4tjkiQN
…ller Marsita, 2026-09-19: "for pushing reports no test required? it's just plain text... I'm comfy with risk -> document the rule -> but someone can override it and attach extra files to report job?" The rule is now in the hook and in the diff, not in who runs it: the files between the remote sha and the pushed sha are listed, and only if every one is under docs/report/ does the push go out untested. One extra file anywhere else, or a new branch with no remote point to judge from, gets the full suite. No env var, no script name, no caller trust. Simulated: report-only range -> skipped by rule (4 files); a range that also carries code -> full suite; a new branch -> full suite. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmAXMHTsfEdyB4H4tjkiQN
"this sounds like it will be exploited one day, please be smart when using it :)" Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmAXMHTsfEdyB4H4tjkiQN
"this is a loophole, might be abused, trust me bro", with the commit and the file list, in fleet/logs/pre-push.log. The post-mortem is a grep, not a guess. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmAXMHTsfEdyB4H4tjkiQN
The report-only skip is gone, with its log and its warning label. Marsita, 2026-09-19: "no footguns. Github actions, commit, run tests, by default, not skip... No footguns, no loopholes, no asking for trouble." Every push runs the whole suite. The report job included: 66 s on Gaia once a day is nothing, and a red suite is a reason the report should not go out either. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmAXMHTsfEdyB4H4tjkiQN
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pairs with branch protection on main (set 2026-09-19 via API:
tests+auditrequired, no force-push, no delete). This hook is the local half: the full suite before every push, every push, red means nothing leaves. No exceptions. Escape hatch is git's own--no-verify, a deliberate human act.Verified: the hook blocked a real push on a red test that is someone's uncommitted WIP; the same test passes on clean main.
🤖 Generated with Claude Code
https://claude.ai/code/session_01AmAXMHTsfEdyB4H4tjkiQN