0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 19:01:54 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 5e75a4b0ad feat(git): add make sign-push and deny direct push in sandbox

Route pushes through scripts/git/sign-push.sh so the operator's GPG key
stays outside the sandbox. Script signs only @{u}..HEAD (or merge-base
with origin/main|master on first push), skips re-signing when all
commits already carry a good signature, and uses --force-with-lease on
rewritten history. settings.json denies git push*, git send-pack*, and
make sign-push* so the agent cannot trigger a push path directly.
CLAUDE.md instructs the agent to hand off to the operator instead.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-19 12:15:44 +02:00

351 B

Raw Blame History

Git Workflow Helpers 🔐

This is the SPOT for Git workflow helper scripts under scripts/git/. These helpers own the Git operations that the Claude sandbox denies, so they run under the operator's control with access to ~/.gnupg and interactive pinentry. For the canonical command index, see make.md.

351 B Raw Blame History

Git Workflow Helpers 🔐

351 B

Raw Blame History