Module pushrefs 

The refs git feeds pre-push on stdin, read ONCE and shared.

git writes one line per ref being pushed:

<local ref> <local oid> <remote ref> <remote oid>

This exists because stdin can only be consumed once. While checks were separate processes with INHERITED stdin, whichever ran first drained it and the rest saw EOF — silently. Two repos in the fleet had a custom pre-push-branch-protect.sh whose while read loop sorted BEFORE pre-push-run-tests-js, so the test gate received no refs and ran nothing. Nobody noticed, because “no refs” and “nothing to test” look identical.

Reading it in one place and lending the result to every check removes that whole class of bug, and makes it impossible to reintroduce by adding a second stdin reader.

Structs

PushRef

PushRefs

Lazily-read pushed refs. OnceLock rather than OnceCell because pre-commit runs its checks on threads and Ctx must therefore be Sync.

Functions

changed_files

Every path touched by the refs being pushed.

changed_files_for

Every path touched by ONE ref being pushed.

parse

synthetic_from_upstream

Synthesise the one PushRef a standalone invocation — no real pre-push on the other end of stdin — has no other way to obtain: @{u}..HEAD.