Skip to content

feat(guardrails): add CI gate, push block, and auto-format hooks #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
terisuke merged 2 commits into from
Apr 6, 2026
Merged

feat(guardrails): add CI gate, push block, and auto-format hooks #102

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2cc9a73
feat(guardrails): add CI gate, push block, and auto-format hooks
terisuke Apr 6, 2026
c104d1e
fix(guardrails): address Codex review findings in advanced hooks #98
terisuke Apr 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions packages/guardrails/profile/plugins/guardrail.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -510,6 +510,29 @@ export default async function guardrail(input: {
throw new Error(text("merge blocked: run /review before merging"))
}
}
// Direct push to protected branches
const protectedBranch = /^(main|master|develop|dev)$/
if (/\bgit\s+push\b/i.test(cmd)) {
// Check explicit branch target
const explicitMatch = cmd.match(/\bgit\s+push\s+\S+\s+(?:HEAD:)?(\S+)/i)
if (explicitMatch && protectedBranch.test(explicitMatch[1])) {
throw new Error(text("direct push to protected branch blocked — use a PR workflow"))
}
// Check refspec form HEAD:branch
const refspecMatch = cmd.match(/HEAD:(main|master|develop|dev)(?:\s|$)/i)
if (refspecMatch) {
throw new Error(text("direct push to protected branch blocked — use a PR workflow"))
}
// Plain `git push` with no branch — check current branch
if (!/\bgit\s+push\s+\S+\s+\S+/i.test(cmd)) {
try {
const result = await git(input.worktree, ["branch", "--show-current"])
if (result.stdout && protectedBranch.test(result.stdout.trim())) {
throw new Error(text("direct push to protected branch blocked — use a PR workflow"))
}
} catch (e) { if (String(e).includes("blocked")) throw e }
}
}
if (!bash(cmd)) return
if (!cfg.some((rule) => rule.test(file)) && !file.includes(".opencode/guardrails/")) return
await mark({ last_block: "bash", last_command: cmd, last_reason: "protected runtime or config mutation" })
Expand Down Expand Up @@ -585,6 +608,15 @@ export default async function guardrail(input: {
if (code(file) && nextEditCount > 0 && nextEditCount % 3 === 0) {
out.output += "\n\n📝 Source code edited (3+ operations). Check if related documentation (README, AGENTS.md, ADRs) needs updating."
}
// Auto-format reminder after 3+ source edits
if (nextEditCount >= 3 && nextEditCount % 3 === 0) {
out.output = (out.output || "") + "\n🎨 " + nextEditCount + " source edits — consider running formatter (`prettier --write`, `biome format`, `go fmt`)."
Comment on lines +611 to +613
Copy link

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This reminder triggers based on total edit/write operations, not “source edits”: it doesn’t check code(file), so edits to docs/config will still emit “N source edits”. Either gate this with code(file) (consistent with the doc reminder above) or adjust the message/counting so it reflects what’s actually being tracked.

Suggested change
// Auto-format reminder after 3+ source edits
if (nextEditCount >= 3 && nextEditCount % 3 === 0) {
out.output = (out.output || "") + "\n🎨 " + nextEditCount + " source edits — consider running formatter (`prettier --write`, `biome format`, `go fmt`)."
// Auto-format reminder after 3+ edit/write operations
if (nextEditCount >= 3 && nextEditCount % 3 === 0) {
out.output = (out.output || "") + "\n🎨 " + nextEditCount + " edit/write operations — consider running formatter (`prettier --write`, `biome format`, `go fmt`)."

Copilot uses AI. Check for mistakes.
}
}

// CI status advisory after push/PR create
if (item.tool === "bash" && /\b(git\s+push|gh\s+pr\s+create)\b/i.test(str(item.args?.command))) {
out.output = (out.output || "") + "\n⚠️ Remember to verify CI status: `gh pr checks`"
}

if (item.tool === "task") {
Expand Down
Loading