From d568d4ecb05517ee59a6ed0d1c17c2d69e32f2ca Mon Sep 17 00:00:00 2001
From: "Hagen, Kody J" <Kody.Hagen@bemidjistate.edu>
Date: Wed, 8 Jul 2026 10:58:58 -0500
Subject: [PATCH] chore(config): guard pre-push by push destination, not
 checked-out branch

The hook keyed off the checked-out branch, so it blocked every push made
while on main or release (including unrelated branch deletions) and let a
direct push to a protected branch through when it came from a
differently-named local branch. Read the refs git streams on stdin and
refuse only when the push destination is main or release; deletions and
every other push are allowed.
---
 .husky/pre-push | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/.husky/pre-push b/.husky/pre-push
index 6dd14fc..d2f4e6c 100644
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -1,18 +1,31 @@
 #!/usr/bin/env sh
 # --- pre-push hook ---
 #
-# Prevent direct pushes to main. All changes to main must go through a pull
-# request from the release branch. Versioning and releases are handled
-# automatically by GitHub Actions on merge.
+# Block direct pushes to main and release. All changes land through a pull
+# request; versioning and releases run in GitHub Actions on merge. Branch
+# deletions and pushes to any other branch are allowed.
 
 . "$(dirname "$0")/bin/dependency-check.sh"
 
-branch=$(git symbolic-ref HEAD 2>/dev/null | sed 's|refs/heads/||')
+zero="0000000000000000000000000000000000000000"
 
-if [ "$branch" = "main" ] || [ "$branch" = "release" ]; then
-	echo ""
-	echo "ERROR: Direct pushes to '$branch' are not allowed."
-	echo "Open a pull request instead."
-	echo ""
-	exit 1
-fi
+# Git streams the refs being pushed on stdin, one per line:
+#   <local ref> <local sha> <remote ref> <remote sha>
+while read -r local_ref local_sha remote_ref remote_sha; do
+
+	# A deletion sends an all-zeros local sha — let it through.
+	if [ "$local_sha" = "$zero" ] || [ -z "$local_sha" ]; then
+		continue
+	fi
+
+	case "$remote_ref" in
+		refs/heads/main | refs/heads/release)
+			echo ""
+			echo "ERROR: Direct pushes to '${remote_ref#refs/heads/}' are not allowed."
+			echo "Open a pull request instead."
+			echo ""
+			exit 1
+			;;
+	esac
+
+done