From 5f22be6ed269a1ea39366237a586f4db31ca58c2 Mon Sep 17 00:00:00 2001
From: Logan Jones <logan@ljones.me>
Date: Sat, 14 Feb 2026 00:12:18 -0600
Subject: [PATCH] ci: add pre-push hook to prevent direct pushes to main (#33)

* ci: add pre-push hook to prevent direct pushes to main

* ci: grant pull-requests read permission to commitlint job
---
 .github/workflows/ci.yml |  2 ++
 Makefile                 |  2 +-
 lefthook.yml             | 12 ++++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64429ae..6a44085 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,8 @@ jobs:
     name: Lint PR Title
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:
diff --git a/Makefile b/Makefile
index 10eb955..2181d7c 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ VERSION ?= dev
 COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
 LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)'
 
-dev: generate clean
+dev: setup generate clean
 	WEBKIT_DISABLE_DMABUF_RENDERER=1 wails dev -tags webkit2_41 -loglevel Debug -v 2
 
 build-dev: generate
diff --git a/lefthook.yml b/lefthook.yml
index 94ec238..abb29e7 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -31,6 +31,18 @@ pre-commit:
 pre-push:
   parallel: true
   commands:
+    protect-main:
+      run: |
+        while read local_ref local_sha remote_ref remote_sha; do
+          if [ "$remote_ref" = "refs/heads/main" ]; then
+            echo "Direct push to main is not allowed. Use a pull request instead."
+            exit 1
+          fi
+        done
+      skip:
+        - merge
+        - rebase
+
     go-test:
       glob: "*.go"
       run: go test -tags webkit2_41 -race -count=1 -timeout 120s ./...