ci: add pre-push hook to prevent direct pushes to main (#33)

* ci: add pre-push hook to prevent direct pushes to main

* ci: grant pull-requests read permission to commitlint job

lefthook.yml

@@ -31,6 +31,18 @@ pre-commit:
 pre-push:
   parallel: true
   commands:
+    protect-main:
+      run: |
+        while read local_ref local_sha remote_ref remote_sha; do
+          if [ "$remote_ref" = "refs/heads/main" ]; then
+            echo "Direct push to main is not allowed. Use a pull request instead."
+            exit 1
+          fi
+        done
+      skip:
+        - merge
+        - rebase
+
     go-test:
       glob: "*.go"
       run: go test -tags webkit2_41 -race -count=1 -timeout 120s ./...