Quite a common use of a git pre-receive hook is to scan for sensitive information and then block from entering the repository. It appears from looking at examples, that conventionally, you are given arguments of the parent and new sha.
Typically, you then use those to run a git show
or git diff
to see the real text and actually run operations on the files, for example, looking for secrets.
I assume if the hashes are provided then the git server actually writes these to the file system so that an invocation of git show
can actually find and display the file.
if the hook returns a fail, such that the push and commit fails, do these fragments get cleaned up? or are they visible to someone that runs git clone
after the hook ran. Also wondering if there are any best practices to configure git so that this storage is somewhere volatile until the commit actually passes the hook and can be safely committed to the repository, so that it would not make it into backup systems and the like that might be archiving the repository.