Repository navigation
chore(claude): release guard lets branch pushes through and asks in every mode - #95
Merged
Merged
Conversation
…very mode A plain branch push (git push -u origin <branch>) is the first half of a pull request, not a deploy, and now passes silently; a push that names main, a tag, HEAD or no branch, or uses --force, --delete, --tags, --mirror or --all, still asks. The bypassPermissions and dontAsk downgrade to deny is gone: Claude Code auto-approves a hook's ask there (verified with a dry-run push), as in Paul's other repos, so the guard is a reminder in bypass sessions and the subagent denial stays the hard stop. Docs, session hook and tests updated. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The release guard turned
askintodenyinbypassPermissionssessions, so every push from the sessions Paul actually runs was refused (2026-10-26). His other repos never special-cased the mode.What changes
git push -u origin <branch>,--force-with-leaseincluded) passes silently: it is the first half of a pull request, not a deploy.main, a tag,HEADor no branch at all, or uses--force,--delete,--mirror,--all,--tagsor a+refspec, still asks, and the reason says what it saw.bypassPermissionsClaude Code auto-approves a hook'sask(verified from this session with a dry-run push namingmain), so there the guard is a reminder; inside a subagent it still denies, and--denystill forces a denial.gh pr merge,gh releasewrites,gh workflow runandgh run rerunare unchanged: ask, deny in subagents.CLAUDE.md,.claude/rules/release.md, the session-context line, the release-manager agent's rules and the hook tests say the same thing.Verification
Worth knowing
In a bypass session nothing mechanical now stands between a
gh pr mergeor a push tomainand the repo, exceptCLAUDE.md's rule that those happen only when you ask. If you want a hard stop there, say so: the hook can deny merges and releases in bypass mode while leaving pushes alone.🤖 Generated with Claude Code