#!/usr/bin/env bash
#
# Prevent direct pushes to the protected `main` branch.
#
# Releases reach `main` only through the automated semantic-release pipeline,
# never by a manual push. This hook is wired in via `.pre-commit-config.yaml`
# (id: prevent-push-to-main, stages: [pre-push]).
#
# Git supplies the refs being pushed on stdin as:
#   <local ref> <local sha> <remote ref> <remote sha>
set -euo pipefail

protected_branch="main"

blocked=0
while read -r _local_ref _local_sha remote_ref _remote_sha; do
  if [[ "${remote_ref}" == "refs/heads/${protected_branch}" ]]; then
    blocked=1
  fi
done

if [[ "${blocked}" -eq 1 ]]; then
  echo "pre-push: direct pushes to '${protected_branch}' are not allowed." >&2
  echo "pre-push: release to '${protected_branch}' via the semantic-release pipeline instead." >&2
  exit 1
fi

exit 0
