# Rail 1: refuse direct pushes to protected branches. Git feeds pre-push one
# line per ref being pushed on stdin ("<local ref> <local sha> <remote ref>
# <remote sha>"); checking the REMOTE ref catches `git push origin HEAD:main`
# too, which a current-branch check would miss. Protected branches only move
# through reviewed pull requests -- the server-side twin of this rail is
# scripts/setup-branch-protection.sh.
while read -r _local_ref _local_sha remote_ref _remote_sha; do
  case "$remote_ref" in
    refs/heads/main | refs/heads/master | refs/heads/production)
      echo "Push blocked: '${remote_ref#refs/heads/}' is a protected branch." >&2
      echo "Open a pull request instead of pushing directly." >&2
      exit 1
      ;;
  esac
done

# Rail 2: the full gate before code leaves the machine — types, lint, formatting, and tests
# over the whole project (not just staged files), so nothing incomplete is pushed even after
# a --no-verify commit. Unit tests only; e2e stays in CI.
pnpm run check
