#!/usr/bin/env rc

# Reject writes to CI-controlled namespaces from git-receive-pack. The
# orchestrator module is the only accepted refs/sip/* receive-path ref.
# Server-side admin tools that need to maintain restricted refs must update
# them outside the client receive path.
awk '
function reject(message) {
	print message > "/dev/stderr"
	bad = 1
}

{
	old = $1
	new = $2
	ref = $3

	if (old !~ "^[0-9a-f]{40}$" || new !~ "^[0-9a-f]{40}$") {
		reject("sip: malformed receive record for " ref)
		next
	}

	if (ref ~ "^refs/(ci|workflows)/")
		reject("sip: updates to " ref " are restricted")

	if (ref ~ "^refs/sip/" && ref != "refs/sip/orchestrator")
		reject("sip: updates to " ref " are not accepted")

	if (ref ~ "^refs/(notes|replace)/")
		reject("sip: updates to " ref " are not accepted")

	if (ref !~ "^refs/(heads|tags|ci|workflows|sip|pull|merge|notes|replace)/")
		reject("sip: updates to unknown ref namespace " ref " are not accepted")
}

END {
	exit bad ? 1 : 0
}
'