메뉴
Runtime enforcement hook that blocks dangerous git operations on protected branches. Prevents force-push, hard reset, and branch deletion on main/master. Auto-loaded for all git operations.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
End-of-session routine. Ensures test coverage, performs self-review, runs validation, and commits cleanly. Use when finishing a unit of work.
Full feature implementation workflow with explore, plan, code, test, validate, and commit phases. Use for new features, enhancements, or significant code changes.
Iterate on an open PR until CI passes and all review feedback is addressed. Fetches status, categorizes findings by severity, applies fixes, and loops until clean.
Create a detailed implementation plan without writing code. Read-only analysis and planning with user approval gate. Use before implementing features or making significant changes.
Systematic security audit with confidence-based reporting. Analyzes attack surfaces, checks against OWASP categories, and reports only confirmed or likely vulnerabilities. Use for pre-merge security review or periodic audits.
Run validation checks to ensure code quality, security, and correctness. Supports quick (scoped), full (CI pipeline), fix (auto-correct), and CI mirror modes.
| name | branch-protection |
| description | Runtime enforcement hook that blocks dangerous git operations on protected branches. Prevents force-push, hard reset, and branch deletion on main/master. Auto-loaded for all git operations. |
| category | enforcement |
| user-invocable | false |
Runtime enforcement hook for Claude Code's PreToolUse hook system. Intercepts Bash tool calls and blocks dangerous git operations on protected branches.
| Command Pattern | Risk | Action |
|---|---|---|
git push --force / git push -f to main/master | Rewrites shared history | Block |
git reset --hard on main/master | Destroys uncommitted work | Block |
git branch -D main / git branch -D master | Deletes protected branch | Block |
git checkout . / git restore . on main/master | Discards all changes | Warn |
git clean -fd | Removes untracked files | Warn |
Add to your Claude Code settings (~/.claude/settings.json or project .claude/settings.json):
{
"hooks": {
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{
"type": "command",
"command": "node .claude/skills/branch-protection/references/hook.js"
}
]
}
]
}
}
The hook reads protected branch names from the environment or defaults to main and master:
export PROTECTED_BRANCHES="main,master,production"
The hook protocol only supports block and passthrough. "Warn"-level operations are implemented as blocks with a softer confirmation-style message — the agent is told to ask the user before retrying.
| ID | Type | Condition | Expected |
|---|---|---|---|
| BP-T1 | Block | git push --force origin main | Blocked with explanation |
| BP-T2 | Block | git reset --hard HEAD~3 on main branch | Blocked with explanation |
| BP-T3 | Block | git branch -D main | Blocked with explanation |
| BP-T4 | Allow | git push --force origin feature/my-branch | Allowed |
| BP-T5 | Allow | git reset --hard HEAD~1 on feature branch | Allowed |
| BP-T6 | Allow | git push origin main (no --force) | Allowed |
| BP-T7 | Warn | git checkout . on main branch | Blocked with safety warning |
| BP-T8 | Warn | git restore . on main branch | Blocked with safety warning |
| BP-T9 | Warn | git clean -fd | Blocked with safety warning |
| BP-T10 | Allow | git checkout . on feature branch | Allowed |
| BP-T11 | Allow | git clean -n (dry run, no -f) | Allowed |