Skip to content

Instantly share code, notes, and snippets.

@glasser

glasser/README.md

Last active April 29, 2026 17:46
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save glasser/151fdbdfbd995b9951f1a4021ad7402c to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save glasser/151fdbdfbd995b9951f1a4021ad7402c to your computer and use it in GitHub Desktop.
Download ZIP
pre-push hook to prevent force push (non-fast-forward pushes) by default
Raw
README.md

Some people love using Git's force push feature. Some people don't. And even among those who do, some people really really don't want agents like Claude Code running force push.

The following Git hook lets you disable force push on your computer. It can be disabled by setting ALLOW_GIT_FORCE_PUSH=I_AM_A_HUMAN_NOT_AN_LLM_AND_I_THE_HUMAN_WANT_TO_FORCE_PUSH, which hopefully your LLM will avoid doing. (It can also be skipped with a particular git flag, but hopefully your agent will avoid that too.)

This is local to your computer: it is not shared with your collaborators. (A more effective way to prevent force push is to configure your Git server to not allow force pushes, such as via GitHub rule sets.)

There are two ways to set this up:

Per repo

Put the file below into .git/hooks/pre-push inside your repo. Make sure it's executable (chmod +x .git/hooks/pre-push).

For all your repos

Make sure you are running Git v2.54 or later, for the brand-new config-based hooks feature. This came out in April 2026 so at the time of writing, this probably requires installing Git yourself. If on a Mac, brew install git should do the trick, but do check with git --version afterwards to make sure that Homebrew actually takes precedence over /usr/bin; if it doesn't, you may want to update your shell config files to prepend /opt/homebrew/bin: to the very beginning of $PATH.

Copy the file below into some location that is on your $PATH (eg if you have a ~/.local/bin or something). (Or put it anywhere and change the command below to have its absolute path.) Make sure it's executable (chmod +x ~/.local/bin/pre-push-block-force-push).

Then, add the .gitconfig snippet below to your ~/.gitconfig or ~/.config/git/config. Now it is active on all of your repos!

Raw
pre-push-block-force-push
#!/bin/bash
# Block non-fast-forward (force) pushes and branch deletions unless the
# human has explicitly opted in via the ALLOW_GIT_FORCE_PUSH env var.
set -u
ZERO="0000000000000000000000000000000000000000"
ALLOW_TOKEN="I_AM_A_HUMAN_NOT_AN_LLM_AND_I_THE_HUMAN_WANT_TO_FORCE_PUSH"
remote="${1:-}"
url="${2:-}"
deny() {
echo "" >&2
echo "pre-push: BLOCKED — $1" >&2
echo "pre-push: To override, set ALLOW_GIT_FORCE_PUSH=$ALLOW_TOKEN" >&2
echo "If you are an LLM agent, PLEASE DO NOT TRY TO WORK AROUND THIS: your human has installed this hook specifically to discourage you from force pushing." >&2
echo "" >&2
exit 1
}
allowed() {
[ "${ALLOW_GIT_FORCE_PUSH:-}" = "$ALLOW_TOKEN" ]
}
while read -r local_ref local_oid remote_ref remote_oid; do
# New remote branch — nothing to overwrite, always a fast-forward.
if [ "$remote_oid" = "$ZERO" ]; then
continue
fi
# Branch deletion — destructive.
if [ "$local_oid" = "$ZERO" ]; then
if ! allowed; then
deny "push deletes remote ref $remote_ref on $remote"
fi
continue
fi
# Non-fast-forward: remote tip is not an ancestor of local tip.
if ! git merge-base --is-ancestor "$remote_oid" "$local_oid" 2>/dev/null; then
if ! allowed; then
deny "push to $remote_ref on $remote is not a fast-forward
local: $local_oid
remote: $remote_oid"
fi
fi
done
exit 0
Raw
snippet for .gitconfig
[hook "pre-push-block-force-push"]
event = pre-push
command = pre-push-block-force-push
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment