Prevent accidental push of security commits

.git_hooks_pre-push

#!/usr/bin/bash

# Store in .git/hooks/pre-push


# Only allow pushes of branches named "security*" and
# commits that include "SECURITY" to the remote
# named $ALLOWED_SECURITY_REMOTE

ALLOWED_SECURITY_REMOTE="security"

remote="$1"
url="$2"

zero=$(git hash-object --stdin </dev/null | tr '[0-9a-f]' '0')

while read local_ref local_oid remote_ref remote_oid
do
	if test "$local_oid" = "$zero"
	then
		# Handle delete
		:
	else
		if test "$remote_oid" = "$zero"
		then
			# New branch, examine all commits
			range="$local_oid"
		else
			# Update to existing branch, examine new commits
			range="$remote_oid..$local_oid"
		fi

		if test "$remote" != "$ALLOWED_SECURITY_REMOTE"
		then
			if [[ "$local_ref" == "refs/heads/security"* ]]
			then
				echo >&2 "Security branch $local_ref must only be pushed to remote '$ALLOWED_SECURITY_REMOTE'."
				exit 1
			fi

			# Check for SECURITY commit
			commit=$(git rev-list -n 1 --grep 'SECURITY' "$range")
			if test -n "$commit"
			then
				echo >&2 "Found SECURITY commit in $local_ref, not pushing to remotes other than '$ALLOWED_SECURITY_REMOTE'."
				exit 1
			fi
		fi
	fi
done

exit 0