Loading...
Prevents direct edits to protected branches like main or master, enforcing PR-based workflows
{
"hookConfig": {
"hooks": {
"preToolUse": {
"script": "./.claude/hooks/git-branch-protection.sh",
"matchers": [
"edit",
"write",
"multiEdit"
]
}
}
},
"scriptContent": "#!/usr/bin/env bash\n\n# Read the tool input from stdin\nINPUT=$(cat)\nTOOL_NAME=$(echo \"$INPUT\" | jq -r '.tool_name')\nFILE_PATH=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // .tool_input.path // \"\"')\n\n# Check if we're in a git repository\nif ! git rev-parse --git-dir > /dev/null 2>&1; then\n # Not in a git repo, allow the operation\n exit 0\nfi\n\n# Get current branch\nCURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)\n\nif [ -z \"$CURRENT_BRANCH\" ]; then\n # Can't determine branch, allow operation with warning\n echo \"⚠️ Warning: Unable to determine current Git branch\" >&2\n exit 0\nfi\n\necho \"🔍 Checking branch protection for: $CURRENT_BRANCH\" >&2\n\n# Define protected branches (can be customized via environment variables)\nPROTECTED_BRANCHES=()\n\n# Default protected branches\nDEFAULT_PROTECTED=(\"main\" \"master\" \"production\" \"prod\" \"release\" \"staging\" \"develop\")\n\n# Add custom protected branches from environment variable\nif [ -n \"$PROTECTED_BRANCHES_LIST\" ]; then\n IFS=',' read -ra CUSTOM_PROTECTED <<< \"$PROTECTED_BRANCHES_LIST\"\n PROTECTED_BRANCHES+=(\"${CUSTOM_PROTECTED[@]}\")\nelse\n PROTECTED_BRANCHES+=(\"${DEFAULT_PROTECTED[@]}\")\nfi\n\n# Check if current branch is protected\nIS_PROTECTED=false\nfor protected_branch in \"${PROTECTED_BRANCHES[@]}\"; do\n if [[ \"$CURRENT_BRANCH\" == \"$protected_branch\" ]]; then\n IS_PROTECTED=true\n break\n fi\ndone\n\n# Check for pattern-based protection (e.g., release/* branches)\nPROTECTED_PATTERNS=(\"release/*\" \"hotfix/*\" \"support/*\")\nif [ -n \"$PROTECTED_PATTERNS_LIST\" ]; then\n IFS=',' read -ra CUSTOM_PATTERNS <<< \"$PROTECTED_PATTERNS_LIST\"\n PROTECTED_PATTERNS+=(\"${CUSTOM_PATTERNS[@]}\")\nfi\n\nfor pattern in \"${PROTECTED_PATTERNS[@]}\"; do\n if [[ \"$CURRENT_BRANCH\" == $pattern ]]; then\n IS_PROTECTED=true\n break\n fi\ndone\n\n# Allow override in emergency situations\nif [ \"$FORCE_ALLOW_PROTECTED_EDIT\" = \"true\" ]; then\n echo \"⚠️ EMERGENCY OVERRIDE: Allowing edit on protected branch $CURRENT_BRANCH\" >&2\n echo \"💡 Remove FORCE_ALLOW_PROTECTED_EDIT=true when done\" >&2\n exit 0\nfi\n\n# If branch is protected, prevent the operation\nif [ \"$IS_PROTECTED\" = true ]; then\n echo \"\" >&2\n echo \"🚫 BRANCH PROTECTION VIOLATION\" >&2\n echo \"=====================================\" >&2\n echo \"❌ Direct edits to '$CURRENT_BRANCH' branch are not allowed\" >&2\n echo \"\" >&2\n echo \"🔒 Protected branches: ${PROTECTED_BRANCHES[*]}\" >&2\n echo \"🔒 Protected patterns: ${PROTECTED_PATTERNS[*]}\" >&2\n echo \"\" >&2\n echo \"✅ Recommended workflow:\" >&2\n echo \" 1. Create a feature branch:\" >&2\n echo \" git checkout -b feature/your-feature-name\" >&2\n echo \"\" >&2\n echo \" 2. Make your changes on the feature branch\" >&2\n echo \"\" >&2\n echo \" 3. Push and create a Pull Request:\" >&2\n echo \" git push -u origin feature/your-feature-name\" >&2\n echo \"\" >&2\n \n # Suggest specific branch names based on the file being edited\n if [ -n \"$FILE_PATH\" ]; then\n BASE_NAME=$(basename \"$FILE_PATH\" | cut -d. -f1)\n SUGGESTED_BRANCH=\"feature/update-${BASE_NAME}\"\n echo \"💡 Suggested branch name: $SUGGESTED_BRANCH\" >&2\n echo \" Quick command: git checkout -b $SUGGESTED_BRANCH\" >&2\n echo \"\" >&2\n fi\n \n # Show current branch status\n echo \"📊 Current repository status:\" >&2\n echo \" Current branch: $CURRENT_BRANCH\" >&2\n \n # Show available branches\n AVAILABLE_BRANCHES=$(git branch | grep -v \"\\*\" | head -5 | xargs)\n if [ -n \"$AVAILABLE_BRANCHES\" ]; then\n echo \" Available branches: $AVAILABLE_BRANCHES\" >&2\n fi\n \n # Check if there are uncommitted changes\n if [ -n \"$(git status --porcelain 2>/dev/null)\" ]; then\n echo \" ⚠️ You have uncommitted changes\" >&2\n echo \" 💡 Consider: git stash (to save changes temporarily)\" >&2\n fi\n \n echo \"\" >&2\n echo \"🆘 Emergency override (use with caution):\" >&2\n echo \" FORCE_ALLOW_PROTECTED_EDIT=true [your command]\" >&2\n echo \"\" >&2\n echo \"📚 Branch protection helps maintain:\" >&2\n echo \" • Code quality through peer review\" >&2\n echo \" • Stable main/master branches\" >&2\n echo \" • Proper CI/CD pipeline execution\" >&2\n echo \" • Team collaboration standards\" >&2\n echo \"\" >&2\n \n # Exit with error to prevent the tool from running\n exit 1\nfi\n\n# Branch is not protected, show informational message\necho \"✅ Branch '$CURRENT_BRANCH' is not protected - operation allowed\" >&2\n\n# Show branch protection tips for unprotected branches\nif [[ \"$CURRENT_BRANCH\" == feature/* ]] || [[ \"$CURRENT_BRANCH\" == bugfix/* ]] || [[ \"$CURRENT_BRANCH\" == hotfix/* ]]; then\n echo \"💡 Working on feature branch - remember to create a PR when ready\" >&2\nfi\n\n# Check if branch is ahead/behind remote\nif git rev-parse --verify \"origin/$CURRENT_BRANCH\" > /dev/null 2>&1; then\n AHEAD=$(git rev-list --count \"origin/$CURRENT_BRANCH\"..HEAD 2>/dev/null || echo \"0\")\n BEHIND=$(git rev-list --count HEAD..\"origin/$CURRENT_BRANCH\" 2>/dev/null || echo \"0\")\n \n if [ \"$AHEAD\" -gt 0 ]; then\n echo \"📤 Branch is $AHEAD commits ahead of origin\" >&2\n fi\n \n if [ \"$BEHIND\" -gt 0 ]; then\n echo \"📥 Branch is $BEHIND commits behind origin - consider pulling\" >&2\n fi\nfi\n\n# All checks passed, allow the operation\nexit 0"
}.claude/hooks/~/.claude/hooks/{
"hooks": {
"preToolUse": {
"script": "./.claude/hooks/git-branch-protection.sh",
"matchers": [
"edit",
"write",
"multiEdit"
]
}
}
}#!/usr/bin/env bash
# Read the tool input from stdin
INPUT=$(cat)
TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name')
FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // ""')
# Check if we're in a git repository
if ! git rev-parse --git-dir > /dev/null 2>&1; then
# Not in a git repo, allow the operation
exit 0
fi
# Get current branch
CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
if [ -z "$CURRENT_BRANCH" ]; then
# Can't determine branch, allow operation with warning
echo "⚠️ Warning: Unable to determine current Git branch" >&2
exit 0
fi
echo "🔍 Checking branch protection for: $CURRENT_BRANCH" >&2
# Define protected branches (can be customized via environment variables)
PROTECTED_BRANCHES=()
# Default protected branches
DEFAULT_PROTECTED=("main" "master" "production" "prod" "release" "staging" "develop")
# Add custom protected branches from environment variable
if [ -n "$PROTECTED_BRANCHES_LIST" ]; then
IFS=',' read -ra CUSTOM_PROTECTED <<< "$PROTECTED_BRANCHES_LIST"
PROTECTED_BRANCHES+=("${CUSTOM_PROTECTED[@]}")
else
PROTECTED_BRANCHES+=("${DEFAULT_PROTECTED[@]}")
fi
# Check if current branch is protected
IS_PROTECTED=false
for protected_branch in "${PROTECTED_BRANCHES[@]}"; do
if [[ "$CURRENT_BRANCH" == "$protected_branch" ]]; then
IS_PROTECTED=true
break
fi
done
# Check for pattern-based protection (e.g., release/* branches)
PROTECTED_PATTERNS=("release/*" "hotfix/*" "support/*")
if [ -n "$PROTECTED_PATTERNS_LIST" ]; then
IFS=',' read -ra CUSTOM_PATTERNS <<< "$PROTECTED_PATTERNS_LIST"
PROTECTED_PATTERNS+=("${CUSTOM_PATTERNS[@]}")
fi
for pattern in "${PROTECTED_PATTERNS[@]}"; do
if [[ "$CURRENT_BRANCH" == $pattern ]]; then
IS_PROTECTED=true
break
fi
done
# Allow override in emergency situations
if [ "$FORCE_ALLOW_PROTECTED_EDIT" = "true" ]; then
echo "⚠️ EMERGENCY OVERRIDE: Allowing edit on protected branch $CURRENT_BRANCH" >&2
echo "💡 Remove FORCE_ALLOW_PROTECTED_EDIT=true when done" >&2
exit 0
fi
# If branch is protected, prevent the operation
if [ "$IS_PROTECTED" = true ]; then
echo "" >&2
echo "🚫 BRANCH PROTECTION VIOLATION" >&2
echo "=====================================" >&2
echo "❌ Direct edits to '$CURRENT_BRANCH' branch are not allowed" >&2
echo "" >&2
echo "🔒 Protected branches: ${PROTECTED_BRANCHES[*]}" >&2
echo "🔒 Protected patterns: ${PROTECTED_PATTERNS[*]}" >&2
echo "" >&2
echo "✅ Recommended workflow:" >&2
echo " 1. Create a feature branch:" >&2
echo " git checkout -b feature/your-feature-name" >&2
echo "" >&2
echo " 2. Make your changes on the feature branch" >&2
echo "" >&2
echo " 3. Push and create a Pull Request:" >&2
echo " git push -u origin feature/your-feature-name" >&2
echo "" >&2
# Suggest specific branch names based on the file being edited
if [ -n "$FILE_PATH" ]; then
BASE_NAME=$(basename "$FILE_PATH" | cut -d. -f1)
SUGGESTED_BRANCH="feature/update-${BASE_NAME}"
echo "💡 Suggested branch name: $SUGGESTED_BRANCH" >&2
echo " Quick command: git checkout -b $SUGGESTED_BRANCH" >&2
echo "" >&2
fi
# Show current branch status
echo "📊 Current repository status:" >&2
echo " Current branch: $CURRENT_BRANCH" >&2
# Show available branches
AVAILABLE_BRANCHES=$(git branch | grep -v "\*" | head -5 | xargs)
if [ -n "$AVAILABLE_BRANCHES" ]; then
echo " Available branches: $AVAILABLE_BRANCHES" >&2
fi
# Check if there are uncommitted changes
if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
echo " ⚠️ You have uncommitted changes" >&2
echo " 💡 Consider: git stash (to save changes temporarily)" >&2
fi
echo "" >&2
echo "🆘 Emergency override (use with caution):" >&2
echo " FORCE_ALLOW_PROTECTED_EDIT=true [your command]" >&2
echo "" >&2
echo "📚 Branch protection helps maintain:" >&2
echo " • Code quality through peer review" >&2
echo " • Stable main/master branches" >&2
echo " • Proper CI/CD pipeline execution" >&2
echo " • Team collaboration standards" >&2
echo "" >&2
# Exit with error to prevent the tool from running
exit 1
fi
# Branch is not protected, show informational message
echo "✅ Branch '$CURRENT_BRANCH' is not protected - operation allowed" >&2
# Show branch protection tips for unprotected branches
if [[ "$CURRENT_BRANCH" == feature/* ]] || [[ "$CURRENT_BRANCH" == bugfix/* ]] || [[ "$CURRENT_BRANCH" == hotfix/* ]]; then
echo "💡 Working on feature branch - remember to create a PR when ready" >&2
fi
# Check if branch is ahead/behind remote
if git rev-parse --verify "origin/$CURRENT_BRANCH" > /dev/null 2>&1; then
AHEAD=$(git rev-list --count "origin/$CURRENT_BRANCH"..HEAD 2>/dev/null || echo "0")
BEHIND=$(git rev-list --count HEAD.."origin/$CURRENT_BRANCH" 2>/dev/null || echo "0")
if [ "$AHEAD" -gt 0 ]; then
echo "📤 Branch is $AHEAD commits ahead of origin" >&2
fi
if [ "$BEHIND" -gt 0 ]; then
echo "📥 Branch is $BEHIND commits behind origin - consider pulling" >&2
fi
fi
# All checks passed, allow the operation
exit 0Hook blocks edits even when FORCE_ALLOW_PROTECTED_EDIT set to true
Environment variable not exported to hook subprocess. Use: 'export FORCE_ALLOW_PROTECTED_EDIT=true' before command. Or add to .bashrc/.zshrc for session-wide availability.
Protected branch pattern matching fails for release/* branches
Bash pattern requires proper glob: use 'case "$CURRENT_BRANCH" in release/*) IS_PROTECTED=true;;' instead of [[ match. Or use regex: '[[ "$CURRENT_BRANCH" =~ ^release/ ]]'.
Custom protected branches from PROTECTED_BRANCHES_LIST ignored
CSV parsing expects exact format. Ensure no spaces: 'main,staging,prod' not 'main, staging, prod'. Or handle: 'IFS=',' read -ra CUSTOM | tr -d ' '' stripping whitespace.
Branch detection fails in detached HEAD state showing empty branch
git rev-parse --abbrev-ref returns 'HEAD' when detached. Add check: 'if [ "$CURRENT_BRANCH" = "HEAD" ]; then echo "Detached HEAD allowed"; exit 0; fi' before protection logic.
Suggested branch names contain special characters breaking git commands
Filename with spaces/slashes creates invalid branch names. Sanitize: 'SUGGESTED=$(echo "$BASE_NAME" | tr ' /' '-' | tr -cd 'a-zA-Z0-9-')' removing unsafe characters before suggestion.
Loading reviews...
Join our community of Claude power users. No spam, unsubscribe anytime.
Automated accessibility testing and compliance checking for web applications following WCAG guidelines
Automatically generates or updates API documentation when endpoint files are modified
Automatically formats code files after Claude writes or edits them using Prettier, Black, or other formatters