The pre-push large-blob check diffed the pushed tree only against the
remote's old tree for the same ref. After rebasing a stale branch past
an unrelated large-file change on the default branch, that diff shows
the large file as changed even though the exact blob is already on the
remote via main, rejecting the push with a false positive.
Diff against every available base tree instead: the remote's old
commit for the ref plus the merge base with the remote's default
branch. Only flag a file that is a large addition relative to all
bases, so blobs the remote already has are not reported, while
genuinely new large files on the branch are still rejected.
Updates tailscale/corp#9863
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: Ia0c98fc1f5ab67a2913f948aeff605c72641ada7
Add a large blob check to the pre-push hook, using the same git tree
diff logic as corp's check-file-size CI workflow (the
check-git-accidental-large-file GitHub Action): diff the pushed tree
against the remote's old tree (or the merge base with the remote's
default branch for new refs) and reject any new or changed blob over
1.5 MB. Unlike the CI check, which only guards PRs into main, the hook
runs before pushing to any branch, catching mistakes before they
permanently bloat the remote repo.
Set TS_SKIP_LARGE_FILE_CHECK=1 to push a large file intentionally,
mirroring the skip-large-file-check commit message tag honored by CI.
This folds the go.mod replace check and the new check into a single
CheckPrePush entry point so both share one read of the hook's stdin;
corp's git-hook.go needs the matching call site update when it next
bumps its tailscale.com dependency.
Updates tailscale/corp#9863
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I1c8cf2a277ce854d45c0ea809bed7c06b3295374
Brad Fitzpatrick