# Bare repo structure
/srv/git/myproject.git/
├── HEAD
├── config
├── hooks/           ← hooks live here
│   ├── pre-receive
│   ├── update
│   └── post-receive
├── objects/
└── refs/

# On the server, activate a hook
chmod +x /srv/git/myproject.git/hooks/pre-receive

0000000000000000000000000000000000000000 a1b2c3d4... refs/heads/feature/login
b3c4d5e6... f7a8b9c0... refs/heads/main

#!/usr/bin/env bash
set -euo pipefail

ZERO_SHA="0000000000000000000000000000000000000000"
PROTECTED="main master release"

while read old_sha new_sha ref_name; do
  branch="${ref_name#refs/heads/}"

  for protected in $PROTECTED; do
    if [ "$branch" = "$protected" ]; then
      # Detect force-push: old commit is not an ancestor of new commit
      if [ "$old_sha" != "$ZERO_SHA" ]; then
        if ! git merge-base --is-ancestor "$old_sha" "$new_sha" 2>/dev/null; then
          echo "✗ Force-push to '$branch' is not allowed."
          echo "  Branch '$branch' is protected."
          exit 1
        fi
      fi
    fi
  done
done

exit 0

#!/usr/bin/env bash
set -euo pipefail

REF_NAME="$1"
OLD_SHA="$2"
NEW_SHA="$3"

# Only validate branch refs
if [[ "$REF_NAME" != refs/heads/* ]]; then
  exit 0
fi

BRANCH="${REF_NAME#refs/heads/}"
ZERO_SHA="0000000000000000000000000000000000000000"

# Allow deletions
if [ "$NEW_SHA" = "$ZERO_SHA" ]; then
  exit 0
fi

# Enforce naming: main, develop, feature/*, fix/*, hotfix/*, release/*, chore/*
VALID_PATTERN='^(main|master|develop|feature/.+|fix/.+|hotfix/.+|release/.+|chore/.+|docs/.+)$'

if ! echo "$BRANCH" | grep -qE "$VALID_PATTERN"; then
  echo "✗ Branch name '$BRANCH' does not follow the naming convention."
  echo ""
  echo "  Allowed patterns:"
  echo "    main, develop"
  echo "    feature/<description>"
  echo "    fix/<description>"
  echo "    hotfix/<description>"
  echo "    release/<version>"
  echo "    chore/<description>"
  echo "    docs/<description>"
  echo ""
  echo "  Example: git branch -m $BRANCH feature/$(echo $BRANCH | tr ' ' '-')"
  exit 1
fi

# Enforce max branch name length
if [ ${#BRANCH} -gt 100 ]; then
  echo "✗ Branch name is too long (${#BRANCH} chars). Max: 100."
  exit 1
fi

exit 0

#!/usr/bin/env bash

SLACK_WEBHOOK_URL="https://hooks.slack.com/services/T.../B.../..."

while read old_sha new_sha ref_name; do
  branch="${ref_name#refs/heads/}"
  pusher=$(git log -1 --pretty=format:'%an' "$new_sha")
  message=$(git log -1 --pretty=format:'%s' "$new_sha")
  short_sha=$(echo "$new_sha" | cut -c1-8)

  payload=$(cat <<JSON
{
  "text": "*[$branch]* $pusher pushed `$short_sha`: $message"
}
JSON
)

  curl -s -X POST -H 'Content-type: application/json'     --data "$payload"     "$SLACK_WEBHOOK_URL"
done

#!/usr/bin/env bash

CI_WEBHOOK="https://ci.example.com/webhook/build"
REPO_NAME=$(basename "$(pwd)" .git)

while read old_sha new_sha ref_name; do
  branch="${ref_name#refs/heads/}"

  # Only trigger CI for main and feature branches
  if [[ "$branch" != "main" && "$branch" != feature/* ]]; then
    continue
  fi

  curl -s -X POST "$CI_WEBHOOK"     -H "Content-Type: application/json"     -d "{"repo":"$REPO_NAME","branch":"$branch","sha":"$new_sha"}"

  echo "CI build triggered for $branch ($new_sha)"
done

#!/usr/bin/env bash

while read old_sha new_sha ref_name; do
  branch="${ref_name#refs/heads/}"

  if [ "$branch" = "main" ]; then
    echo "Deploying to production..."
    # Run your deployment script
    /srv/deploy/deploy.sh "$new_sha" >> /var/log/deploy.log 2>&1 &
    echo "Deployment started in background. Check /var/log/deploy.log"
  fi
done

#!/usr/bin/env bash
set -euo pipefail

REF_NAME="$1"
OLD_SHA="$2"
NEW_SHA="$3"
ZERO_SHA="0000000000000000000000000000000000000000"

# Only check branch updates (not tags or deletions)
if [[ "$REF_NAME" != refs/heads/* ]] || [ "$NEW_SHA" = "$ZERO_SHA" ]; then
  exit 0
fi

# Determine the range of new commits
if [ "$OLD_SHA" = "$ZERO_SHA" ]; then
  # New branch — check all commits reachable from NEW_SHA but not from other branches
  RANGE="$NEW_SHA"
  COMMITS=$(git rev-list --not --branches "$RANGE" 2>/dev/null || git rev-list "$RANGE" | head -50)
else
  COMMITS=$(git rev-list "$OLD_SHA..$NEW_SHA")
fi

PATTERN='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)((.+))?: .{1,72}'

while IFS= read -r sha; do
  [ -z "$sha" ] && continue
  MSG=$(git log -1 --pretty=%s "$sha")

  # Skip merge commits
  if echo "$MSG" | grep -qE '^Merge '; then
    continue
  fi

  if ! echo "$MSG" | grep -qE "$PATTERN"; then
    echo "✗ Commit $sha has an invalid message:"
    echo "  '$MSG'"
    echo "  Expected: <type>(scope): <description>"
    exit 1
  fi
done <<< "$COMMITS"

exit 0

# On the server
git init --bare /srv/git/testrepo.git

cat > /srv/git/testrepo.git/hooks/pre-receive << 'EOF'
#!/usr/bin/env bash
echo "pre-receive: push received"
while read old new ref; do
  echo "  Updating $ref: $old -> $new"
done
exit 0
EOF

chmod +x /srv/git/testrepo.git/hooks/pre-receive

# From a client
git remote add server git@server:/srv/git/testrepo.git
git push server main