git hook pre-push bash 脚本验证标签

Question

I'm trying to validate a git tag using the pre-push git hook but whenever I execute git push origin <tag-name> it takes the previous tag as the latest from /refs/tags.

To replicate the issue:

Step 1. git commit 
step 2. git tag V1.0.0-US123-major
step 3. git push origin V1.0.0-US123-major

So when step 3 executes the pre-push script should take "V1.0.0-US123-major" tag and validates against the below regex. If the tag matches with regex then it is a valid tag else abort git push.

#!/bin/sh
read_tag="$(git describe --abbrev=0 --tags)"
if [[ $read_tag =~ (^v[0-9]{1}.[0-9]{1}.[0-9]{1}-[a-zA-Z]+-[a-zA-Z]+$) ]]; then
    echo "matched"
    
else
    echo "not matched"
    exit 1
fi

My expectation is when I use git push origin 2.2.2.2 , the pre-push script does not return exit1 rather it accepts the tag and pushing to origin which is not correct.

git push origin 2.2.2
latest tag: v5.5.5-abcd-tues
matched

Can someone help me with this, please?

Answer 1

Your pre-push hook is checking the current revision, not the tag you're pushing, because git describe describes HEAD if you don't specify otherwise.

When you use a pre-push hook, the references being pushed are passed in on standard input. Assuming the thing you want to check is the name of the remote reference (that is, the one that's going to end up on the server), then it could look something like this (using POSIX syntax):

#!/bin/sh

set -e

while read lref new rref old
do
    case $rref in
        refs/tags/*)
            if echo "$rref" | \
                grep -qsE '(^refs/tags/v[0-9]{1}.[0-9]{1}.[0-9]{1}-[a-zA-Z]+-[a-zA-Z]+$)'
            then
                echo "matched"
            else
                echo "not matched"
                exit 1
            fi;;
        *)
            ;;
    esac
done

Do note that while a pre-push hook can help the developer make good choices and avoid mistakes, it's not an effective control, because it can be trivially bypassed. If you need to restrict what gets pushed to the server, you need to do that either with a pre-receive hook, your server implementation, or a CI system. See the relevant Git FAQ entry for more.