Use case · Version control

Protect git history during release weeks

Keep history-replacing git operations and GitHub maintenance commands from running without a decision.

The most expensive agent mistakes are the ones that discard work: force-pushes, hard resets, and cleanups, plus gh CLI commands that merge, delete, or mutate repository state. Git protection is part of Guard’s required safety floor, and the GitHub entry reviews the maintenance and mutation surfaces through the gh CLI.

Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12

Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.

When this is not the right fit

Skip this workflow if

  • Your team only reads history — everyday git read commands are documented separately in the catalog’s read-command class rather than as destructive operations.
  • You use a forge other than GitHub for remote maintenance; the GitHub entry documents gh CLI capabilities.

Prerequisites

Before you start

  • Guard is installed on the development machine (git protection is part of the required set where its tools apply).
  • You know which gh CLI workflows your release process uses.

Steps

The workflow

  1. 1

    Rely on the required git floor

    The git entry reviews everyday porcelain plus local and remote operations that can discard work or replace history — force-push, hard reset, force clean, local and remote branch deletion among them. Its protection model is required and it is maintained first-party.

    Git protectionTry this coverage Coverage details
  2. 2

    Review GitHub maintenance and mutations

    The GitHub entry reviews distinct maintenance, content, merge, publication, workflow, and control effects through gh — including force mutations, deletions, administrator merges, and workflow mutations.

    GitHub capability protectionTry this coverage Coverage details
  3. 3

    Check the routine-merge class before tightening anything

    The catalog separates routine pull-request merges from administrator merges, so ordinary merges are cataloged in their own action class. Read the entry’s command mapping to see which class a command falls into before changing policy.

    GitHub capability protectionTry this coverage Coverage details

Expected result

What the documented coverage should do

History-replacing git operations pause for review under the required floor, and destructive or administrative gh commands surface for review instead of executing directly. Everyday commits, branches, and reads continue under the workspace policy.

Limitations

What this workflow does not claim

  • Git coverage documents reviewed porcelain operations; exotic plumbing commands are not in the reviewed set.
  • Coverage is limited to the reviewed operations and the surrounding Guard policy, per the catalog’s stated limitations.

Coverage referenced

Extensions in this workflow