Push the current branch:
git push
If the branch has no upstream, first look up the current branch's PR. Treat
an unavailable or ambiguous lookup as a stop condition; only a confirmed
absence of a PR permits the ordinary origin fallback. For a confirmed PR,
require its headRefName to match the checked-out local branch, then inspect
its delivery target:
gh pr view --json isCrossRepository,headRepositoryOwner,headRepository,headRefName,headRefOid,maintainerCanModify
For a cross-repository PR, the PR head owner can push its own fork directly.
When acting as a base-repository maintainer on somebody else's fork,
maintainerCanModify must be true; do not treat that field as a universal
fork-owner gate. Push the exact current commit to the reported head owner,
repository, and ref. Before using the HTTPS URL, configure Git to use the
authenticated gh credential helper:
gh auth setup-git
git push "https://github.com/<head-owner>/<head-repository>.git" "HEAD:refs/heads/<head-ref>"
If that push fails with git repository does not match any credential lease scope, do not put a token in command arguments or logs. Retry after
gh auth setup-git; if HTTPS still rejects the contributor-fork push, use
the SSH fallback below or report the authentication/scope blocker.
Never embed the token in a remote URL, command argument, log, or persisted
credential. Re-fetch the PR and require its headRefOid to equal local
HEAD afterward.
If HTTPS still rejects a contributor-fork push and SSH authentication is
available, verify the exact target with
git ls-remote git@github.com:<head-owner>/<head-repository>.git, then retry
the same exact ref over SSH (using the exact remote-OID lease if history was
rewritten). Re-fetch and verify the PR head OID again. Do not substitute a
local fork remote or an inferred repository.
Do not use a conveniently named local fork/contributor remote: linked
worktrees share remote configuration, so it can refer to another task.
Re-fetch the PR and require headRefOid to equal local HEAD.
Only for a non-PR or same-repository PR, use git push -u origin HEAD
rather than transcribing the branch name. Then verify
git rev-parse HEAD equals , and report the
branch from .
If the branch was rebased or history was rewritten, first confirm the current
branch is not or , then use the exact remote-OID lease
.
Use generic only when no remote OID was captured; never
use an unconditional force push.
If the branch modifies and GitHub rejects the push with
a message like , treat it as push authentication/scope, not a code
or branch-protection failure. Retry with an SSH remote when available, for
example , or tell the
user the token needs scope.
