From 8eab2d1e5fccc9f6e400bfe2142d54908739b9bc Mon Sep 17 00:00:00 2001 From: nstarman Date: Tue, 15 Sep 2026 10:23:46 -0400 Subject: [PATCH 1/2] ci(pre-commit): protect main and versions/ branches from direct commits Adds the no-commit-to-branch hook from pre-commit-hooks, blocking direct commits to main and any versions/* branch. Runs on pre-commit.ci and locally via `pre-commit run`. Co-Authored-By: Claude Sonnet 5 --- .pre-commit-config.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index ed9e516..5f08cf9 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -25,6 +25,8 @@ repos: - id: mixed-line-ending - id: name-tests-test args: ["--pytest-test-first"] + - id: no-commit-to-branch + args: ["--branch", "main", "--pattern", "^versions/.*"] - id: requirements-txt-fixer - id: trailing-whitespace From 316b6d9f6fa422b420b44b1ef7472ec3a311ba62 Mon Sep 17 00:00:00 2001 From: nstarman Date: Tue, 15 Sep 2026 10:33:36 -0400 Subject: [PATCH 2/2] ci: explicitly set always_run: true on no-commit-to-branch always_run is already the hook's shipped default, but setting it explicitly documents that this hook intentionally ignores any files/exclude/types filtering (and would still allow --allow-empty commits through). Co-Authored-By: Claude Sonnet 5 --- .pre-commit-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5f08cf9..abab9e3 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -27,6 +27,7 @@ repos: args: ["--pytest-test-first"] - id: no-commit-to-branch args: ["--branch", "main", "--pattern", "^versions/.*"] + always_run: true - id: requirements-txt-fixer - id: trailing-whitespace