devops-git-guardrailslisted

# DevOps Git Guardrails Claude Code hooks that block dangerous git commands before they execute. ## What Gets Blocked | Command Pattern | Why | |---|---| | `git push --force` / `git push -f` | Overwrites remote history — can destroy teammates' work | | `git reset --hard` | Discards uncommitted changes without recovery | | `git branch -D main` / `git branch -D master` | Deletes the main branch | | `git add .` / `git add -A` | Stages everything including secrets and generated files | | `git commit --amend` on a pushed commit | Rewrites published history | ## Installation **Project-scoped only.** Write to the project's `.claude/settings.json` — never to `~/.claude/settings.json`. Nothing in this system installs globally, and a global hook would fire in every unrelated repo on the machine. **Merge, don't overwrite.** `.claude/settings.json` usually already holds other keys (`permissions` especially). Read it first and add the `hooks` entry; a blind write destroys whatever was there: ```bash mkdir -p .claude/hooks python3 - <<'PY' import json, os, pathlib p = pathlib.Path(".claude/settings.json") cfg = json.loads(p.read_text()) if p.exists() and p.read_text().strip() else {} entry = {"matcher": "Bash", "hooks": [{"type": "command", "command": "bash .claude/hooks/git-guardrails.sh"}]} pre = cfg.setdefault("hooks", {}).setdefault("PreToolUse", []) if not any(h.get("hooks", [{}])[0].get("command", "").endswith("git-guardrails.sh") for h in pre if h.get("hoo