restrict branch names

get_hooks.py

#!/usr/bin/env python

import sys
import os
import subprocess
import logging
import re
import getpass

logging.basicConfig(level=logging.DEBUG, format="%(levelname)s: %(message)s\n")
priveledged_users = ['ci-bot']


def git(args, **kwargs):
    environ = os.environ.copy()
    if 'repo' in kwargs:
        environ['GIT_DIR'] = kwargs['repo']
    if 'work' in kwargs:
        environ['GIT_WORK_TREE'] = kwargs['work']
    proc = subprocess.Popen(args, stdout=subprocess.PIPE, env=environ)
    return proc.communicate()


def get_changed_files(base, commit, **kw):
    (results, code) = git(('git', 'diff', '--numstat', '--name-only', "%s..%s" % (base, commit)), **kw)
    return results.strip().split('\n')


def get_new_file(filename, commit):
    (results, code) = git(('git', 'show', '%s:%s' % (commit, filename)))
    return results


def validate_branch_name(ref):
    check_branch_name = lambda x: True if re.match(r"^(refs/heads/(feature|bugfix)/[^\/]+)$", x) else False
    check = check_branch_name(ref)
    if not check:
        logging.error("Bad branch name %s", ref)
        return 1
    else:
        return 0


def main():
    repo = os.getcwd()
    basedir = os.path.join(repo, "..")
    line = sys.stdin.read()
    (base, commit, ref) = line.strip().split()
    user = getpass.getuser()
    if user in priveledged_users:
        return 0
    else:
        return validate_branch_name(ref)


if __name__ == "__main__":
    exit(main())