From 0ee8f260727f3e88d26d06f59e5c2fa71211a06d Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 13 May 2026 13:43:34 +0100
Subject: feat(git): global pre-push hook rejecting unsigned commits

Activated via core.hooksPath = ~/.config/git/hooks in the global
git config. The hook walks each ref being pushed (range: remote..local
or, for new branches, local --not --remotes) and checks %G? on every
commit. Accepts G/U/X/Y (good signature variants), rejects N/B/E/R
(no signature, bad, missing key, revoked).

Bypass: git push --no-verify

This repo overrides hooksPath to .githooks/ for its just-check
pre-commit gate, so a thin .githooks/pre-push delegates to the global
hook to keep the policy enforced here too.
---
 dot_config/git/config | 1 +
 1 file changed, 1 insertion(+)

(limited to 'dot_config/git/config')

diff --git a/dot_config/git/config b/dot_config/git/config
index 33687e7..db562a6 100644
--- a/dot_config/git/config
+++ b/dot_config/git/config
@@ -9,6 +9,7 @@
 [core]
     whitespace = trailing-space,cr-at-eol
     pager = delta
+    hooksPath = ~/.config/git/hooks
 [branch]
     sort=-committerdate
 [diff]
-- 
cgit v1.3.1