如何通过编程方式拦截Git Push？特定条件下自动拒推咨询

Hey there! Let's tackle your two questions about intercepting git push operations—this is such a crucial topic for keeping code repos secure, especially when you're worried about accidental leaks of sensitive data.

Git offers two reliable ways to intercept push operations, depending on whether you want to enforce checks locally (on a developer's machine) or on the remote server (where the central repo lives):

客户端拦截：使用pre-push钩子 #

Every Git repo has a hidden .git/hooks folder with sample hook templates. To set up a pre-push hook:

1. Navigate to your repo's .git/hooks directory
2. Create a file named pre-push (no file extension)
3. Make it executable with chmod +x pre-push
4. Write a script (Bash, Python, etc.) that exits with a non-zero code if you want to block the push.

For example, a simple Bash script that blocks all pushes as a test:

#!/bin/bash
echo "Push blocked by pre-push hook! Remove this script to resume pushes."
exit 1

When you run git push, this script triggers first. If it exits with a non-zero code (like 1), Git will abort the push immediately.

⚠️ Pro tip: Client-side hooks are great for personal reminders, but they can be skipped with git push --no-verify, so they're not foolproof for enforced security.

服务器端拦截：使用pre-receive或update钩子 #

If you control the remote Git server (e.g., self-hosted repo, or managing a GitHub/GitLab repo with custom workflows), server-side hooks are the way to go—they can't be bypassed by clients.

• pre-receive: Runs once before any refs are updated, and can block all pushes if it exits non-zero.
• update: Runs once per ref being pushed, so you can block specific branches while allowing others.

To set this up on a server:

1. Access the remote repo's .git/hooks directory
2. Create a pre-receive file, make it executable, and add your custom logic.

Absolutely! You can extend the hook scripts above to scan the content being pushed for sensitive patterns and block the push if any red flags are found. Here's how to implement this:

核心思路：扫描推送的内容差异 #

The key is to compare the content you're pushing against the remote repo's current state. For example, in a pre-receive hook, you can loop through the refs being pushed, get the commit range, and check each file's changes for sensitive data.

示例：Bash脚本检测敏感关键词 #

Here's a sample pre-receive script that scans for common sensitive patterns like AWS keys, passwords, and bank account numbers:

#!/bin/bash

# Define sensitive patterns to flag (tweak these to match your needs)
SENSITIVE_PATTERNS=(
    "aws_secret_access_key"
    "aws_secret_key_id"
    "password\s*=\s*[^\s]+"
    "[0-9]{16,19}"  # Matches most 16-19 digit bank card numbers
)

# Loop through each ref being pushed to the server
while read old_ref new_ref ref_name; do
    # Determine the commit range to check
    if [ "$old_ref" = "0000000000000000000000000000000000000000" ]; then
        # For new branches: check all commits from the start
        commits="$new_ref"
    else
        # For existing branches: check commits between remote and local
        commits="$old_ref..$new_ref"
    fi

    # Check each commit's modified files
    for commit in $(git rev-list $commits); do
        git diff-tree --no-commit-id --name-only -r $commit | while read file; do
            # Scan each file for sensitive patterns
            for pattern in "${SENSITIVE_PATTERNS[@]}"; do
                if git show "$commit:$file" | grep -qi "$pattern"; then
                    echo "❌ ERROR: Sensitive content detected in $file (commit $commit)"
                    echo "Matched pattern: $pattern"
                    exit 1  # Block the push
                fi
            done
        done
    done
done

# If no issues found, allow the push
exit 0

客户端版本（pre-push） #

You can adapt the same logic for a client-side pre-push hook. Instead of comparing against the remote ref, you'd check your local branch against its remote tracking branch:

#!/bin/bash

remote="$1"
url="$2"

# Capture local and remote ref details
read local_ref local_sha remote_ref remote_sha

# Define the commit range to check
commits="$remote_sha..$local_sha"

# Add the same sensitive pattern scanning logic here...

额外实用建议 #

• Tweak regex patterns: Adjust the sensitive patterns to match your organization's specific secrets (e.g., internal API key formats).
• Avoid false positives: Add exceptions for encrypted files or intentionally stored sensitive data (e.g., check file extensions like .env.encrypted before flagging).
• Combine with CI/CD: For hosted repos (GitHub/GitLab), pair hooks with CI pipelines to add an extra layer of scanning—hooks block pushes immediately, while CI can run more in-depth checks before merging.

内容的提问来源于stack exchange，提问作者touch my body