ci: add pre-push hook to prevent direct pushes to main (#33)

* ci: add pre-push hook to prevent direct pushes to main

* ci: grant pull-requests read permission to commitlint job

.github/workflows/ci.yml

@@ -27,6 +27,8 @@ jobs:
     name: Lint PR Title
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

Makefile

@@ -2,7 +2,7 @@ VERSION ?= dev
 COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
 LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)'
 
-dev: generate clean
+dev: setup generate clean
 	WEBKIT_DISABLE_DMABUF_RENDERER=1 wails dev -tags webkit2_41 -loglevel Debug -v 2
 
 build-dev: generate

lefthook.yml

@@ -31,6 +31,18 @@ pre-commit:
 pre-push:
   parallel: true
   commands:
+    protect-main:
+      run: |
+        while read local_ref local_sha remote_ref remote_sha; do
+          if [ "$remote_ref" = "refs/heads/main" ]; then
+            echo "Direct push to main is not allowed. Use a pull request instead."
+            exit 1
+          fi
+        done
+      skip:
+        - merge
+        - rebase
+
     go-test:
       glob: "*.go"
       run: go test -tags webkit2_41 -race -count=1 -timeout 120s ./...