Stop agent pushes to main

The problem

An AI coding agent with shell access can push straight to the default branch: a bare git push while main is checked out, a push with the branch hidden in a variable, or a push buried in a compound command. Branch protection on the hosting side rejects some of these after the fact, but the attempt already ran. A local gate refuses the command before it runs.

What the action gate refuses

The push gate reads the exact command the agent is about to run. It refuses a push whose target resolves to the default branch, including a bare push while the default branch is checked out, branch names hidden behind shell variables or command substitution, and pushes chained with && where any part pushes to the default branch. The merge gate also refuses REST merge calls that would merge without a green check, and merge commands whose pull-request reference cannot be resolved to a checked run.

What still passes

Pushes to feature branches pass untouched, and mentioning a push command inside documentation or a quoted search string does not block the command. The action gate judges the command the agent runs, not words about pushes elsewhere.

Deliberate override

Setting the override in the session environment records an audit entry and lets the push through; writing it inline in the command itself never reaches the action gate, so an agent cannot talk its way past the check by quoting the variable. Keep override sessions short and review what they pushed.

Limits

The action gate sees commands issued through the coding tool it is installed in. A push made outside that tool, or after the action gate is uninstalled, is not checked. An environment override is a deliberate human act and is recorded, not prevented. Pair the action gate with hosting-side branch protection so a push that slips past one layer still meets the other.

References

• OWASP Top 10 for LLM Applications, OWASP GenAI Security Project
• AI Risk Management Framework, NIST
• Hooks reference, Claude Code docs