github-guard 0.1.1

Git & GitHub CLI Guard — prevent dangerous git/gh operations by AI agents
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

# gg - Git & GitHub CLI Guard configuration
#
# Place this file at one of:
#   ./gg.toml
#   $GG_CONFIG
#   ~/.config/gg/config.toml
#   Platform config dir (~/Library/Application Support/gg/config.toml on macOS)
#   ~/.gg.toml

[options]
log = true
deny_by_default = true

# When a command matches both [git] and [gh] rules, which takes priority
priority = "git"

# ── git rules ──────────────────────────────────────────────
[git.rules]
allow = [
    "status*",
    "log*",
    "diff*",
    "show*",
    "branch*",
    "stash list*",
    "remote -v",
    "config --get*",
    "config --list*",
    "blame*",
    "reflog*",
    "tag -l*",
    "tag --list*",
]

confirm = [
    "add*",
    "commit*",
    "push",
    "push origin*",
    "pull*",
    "fetch*",
    "checkout*",
    "switch*",
    "merge*",
    "rebase*",
    "stash*",
    "tag*",
    "remote add*",
    "remote remove*",
]

deny = [
    "push --force*",
    "push -f*",
    "reset --hard*",
    "clean -f*",
    "clean -fd*",
    "clean -fx*",
    "checkout -- .*",
    "restore --source*",
    "config --global*",
    "config --system*",
]

# ── gh rules ───────────────────────────────────────────────
[gh.rules]
allow = [
    "issue list*",
    "issue view*",
    "pr list*",
    "pr view*",
    "pr checks*",
    "pr diff*",
    "pr status*",
    "repo list*",
    "repo view*",
    "release list*",
    "release view*",
    "run list*",
    "run view*",
    "api GET *",
    "search *",
    "status",
    "auth status",
]

confirm = [
    "pr create*",
    "pr comment*",
    "pr review*",
    "pr edit*",
    "pr ready*",
    "issue create*",
    "issue edit*",
    "issue close*",
    "issue comment*",
    "release create*",
    "api POST *",
    "api PATCH *",
    "api PUT *",
]

deny = [
    "pr merge*",
    "pr close*",
    "repo create*",
    "repo delete*",
    "repo rename*",
    "repo archive*",
    "release delete*",
    "api DELETE *",
    "auth login*",
    "auth logout*",
    "ssh-key *",
    "gpg-key *",
    "secret *",
    "variable *",
]