mirror of https://github.com/tailscale/tailscale.git synced 2026-07-29 08:46:33 -04:00

Files

Brad Fitzpatrick 8c98d2a417 misc/git_hook: reject pushes that add large files

Add a large blob check to the pre-push hook, using the same git tree
diff logic as corp's check-file-size CI workflow (the
check-git-accidental-large-file GitHub Action): diff the pushed tree
against the remote's old tree (or the merge base with the remote's
default branch for new refs) and reject any new or changed blob over
1.5 MB. Unlike the CI check, which only guards PRs into main, the hook
runs before pushing to any branch, catching mistakes before they
permanently bloat the remote repo.

Set TS_SKIP_LARGE_FILE_CHECK=1 to push a large file intentionally,
mirroring the skip-large-file-check commit message tag honored by CI.

This folds the go.mod replace check and the new check into a single
CheckPrePush entry point so both share one read of the hook's stdin;
corp's git-hook.go needs the matching call site update when it next
bumps its tailscale.com dependency.

Updates tailscale/corp#9863

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I1c8cf2a277ce854d45c0ea809bed7c06b3295374

2026-07-24 08:22:19 -07:00

1.3 KiB

Raw Blame History

git_hook

Tailscale's git hooks.

The shared logic lives in the githook/ package and is also imported by tailscale/corp.

Install

From the repo root:

./tool/go run ./misc/add-git-hooks.go

The script auto-updates in the future.

Large file check

The pre-push hook rejects pushes that add or change any blob over 1.5 MB, using the same tree diff logic as the check-file-size CI workflow. To push a large file intentionally, set an environment variable:

TS_SKIP_LARGE_FILE_CHECK=1 git push ...

Adding your own hooks

Create an executable .git/hooks/<hook-name>.local to chain a custom script after a built-in hook. For example, put a custom check in .git/hooks/pre-commit.local and chmod +x it. The local hook runs only if the built-in hook succeeds; failure aborts the git operation.

Version bumps

The launcher rebuilds when the installed binary's version differs from the concatenation of two files:

githook/HOOK_VERSION (shared): bump when changing anything under githook/ or git-hook.go. Downstream repos pick it up after bumping their tailscale.com dependency.
misc/git_hook/HOOK_VERSION (repo-local, optional): bump to force a rebuild for repo-specific config changes without touching the shared version. This repo does not use one.

1.3 KiB Raw Blame History