#!/bin/bash

# git pre-push hook script to prevent "fixup!" and "squash!" commit
# from ending up in master, or in any branch if CUR_BRANCH check is removed.
# Furthermore, it disallows pushing branches other than master, release-*
# and maint-* to origin (e.g. gitweb.torproject.org).
#
# To install this script, copy it into .git/hooks/pre-push path in your
# local copy of git repository. Make sure it has permission to execute.
#
# The following sample script was used as starting point:
# https://github.com/git/git/blob/master/templates/hooks--pre-push.sample

z40=0000000000000000000000000000000000000000

remote="$1"
CUR_BRANCH=$(git rev-parse --abbrev-ref HEAD)

# Only allow pushing master, release-* and maint-* branches to origin.
if [ "$remote" == "origin" ]
then
        if  [ "$CUR_BRANCH" != "master" ] && [[ $CUR_BRANCH != release-* ]] &&
             [[ $CUR_BRANCH != maint-* ]]
        then
                echo >&2 "Not pushing $CUR_BRANCH to origin"
                exit 1
        fi
fi

if [ "$CUR_BRANCH" != "master" ] && [[ $CUR_BRANCH != release-* ]] &&
        [[ $CUR_BRANCH != maint-* ]]
then
        exit 0
fi

echo "Running pre-push hook"

# shellcheck disable=SC2034
while read -r local_ref local_sha remote_ref remote_sha
do
	if [ "$local_sha" = $z40 ]
	then
		# Handle delete
		:
	else
		if [ "$remote_sha" = $z40 ]
		then
			# New branch, examine all commits
			range="$local_sha"
		else
			# Update to existing branch, examine new commits
			range="$remote_sha..$local_sha"
		fi

                # Check for fixup! commit
                commit=$(git rev-list -n 1 --grep '^fixup!' "$range")
		if [ -n "$commit" ]
		then
			echo >&2 "Found fixup! commit in $local_ref, not pushing"
			echo >&2 "If you really want to push this, use --no-verify."
			exit 1
		fi

                # Check for squash! commit
                commit=$(git rev-list -n 1 --grep '^squash!' "$range")
		if [ -n "$commit" ]
		then
			echo >&2 "Found squash! commit in $local_ref, not pushing"
			echo >&2 "If you really want to push this, use --no-verify."
			exit 1
		fi
	fi
done

exit 0