Safe Push

Safe Push

Pre-push hygiene check for GitHub repositories. Use when the user asks to push code, especially to public repos.

Trigger

When the user says "push", "safe push", "push to GitHub", or runs /safe-push.

Install

The skill loads patterns from ~/.claude/safe-push-blocklist. Copy the bundled template and customize:

cp safe-push-blocklist.template ~/.claude/safe-push-blocklist
$EDITOR ~/.claude/safe-push-blocklist

The template includes commented-out examples for client names, hostnames, IP ranges, tracking IDs, and Slack token shapes. Replace them with values specific to your environment.

If the file is missing, the skill runs with a warning instead of erroring — but personal pattern checks are skipped, so creating it is strongly recommended.

Procedure

1. Classify the repo

# Check if public repo
git remote -v
# Check for .public-repo marker
test -f .public-repo && echo "PUBLIC" || echo "private or unmarked"

If public (or pushing to a public remote): apply ALL checks below. If private: apply only the PII scan (step 2).

2. PII and secrets scan

Load your personal pattern list from ~/.claude/safe-push-blocklist and scan against it. The same patterns apply to diff content (step 2) AND commit messages (step 3) — both run from the same source of truth.

Default mode — scan the diff against the target branch:

# Load personal patterns (graceful fallback if file missing):
if [ -f ~/.claude/safe-push-blocklist ]; then
  PATTERNS=$(grep -v '^#' ~/.claude/safe-push-blocklist | grep -v '^$' | paste -sd '|' -)
else
  PATTERNS=""
  echo "WARNING: ~/.claude/safe-push-blocklist not found. Personal pattern checks skipped."
fi

git diff origin/main...HEAD
[ -n "$PATTERNS" ] && git diff origin/main...HEAD | grep -nE "$PATTERNS" \
  || echo "NO MATCHES IN DIFF"

Full repo mode (/safe-push --full) — scan ALL tracked files, not just the diff. Use this for baseline audits, first-time pushes of existing repos, or periodic hygiene checks:

git ls-files | xargs grep -n -E "$PATTERNS" \
  --include='*.md' --include='*.py' --include='*.js' --include='*.ts' \
  --include='*.html' --include='*.sh' --include='*.json' \
  --include='*.yml' --include='*.yaml'

Check for these categories (your ~/.claude/safe-push-blocklist covers the regex-able ones):

• Client names or internal project codenames
• Personal infrastructure: hostnames, internal directory names, device IDs, hardware models, self-hosted service names
• Email addresses (personal or client), phone numbers, addresses
• API keys, tokens, secrets (AWS, GitHub, Slack, Telegram, generic)
• Private IP addresses, internal hostnames
• Private key material
• Slack tokens (xoxb-), Slack channel IDs
• Tracking IDs: GA4 (G-XXXXXXXXXX), GTM (GTM-XXXXXXX)

Edit ~/.claude/safe-push-blocklist to maintain your personal patterns. Never hardcode real client names or infrastructure identifiers inside this skill file — the blocklist is the source of truth.

If anything is found:

• List each finding with file, line number, and what was detected
• Ask the user to fix before proceeding
• Do NOT push until resolved

3. Commit message audit

Review the FULL commit message — both subject (title) and body (description) — for every commit in the push range. Sensitive patterns can hide in either:

# Print the full message (subject + body) for every commit:
git log origin/main..HEAD --format="===%h %s===%n%b"

# Programmatically scan the full message text against the same
# blocklist used for diff content (graceful fallback if file missing):
if [ -f ~/.claude/safe-push-blocklist ]; then
  PATTERNS=$(grep -v '^#' ~/.claude/safe-push-blocklist | grep -v '^$' | paste -sd '|' -)
  git log origin/main..HEAD --format="%B" | grep -nE "$PATTERNS" \
    || echo "NO MATCHES IN MESSAGES"
else
  echo "WARNING: ~/.claude/safe-push-blocklist not found. Personal pattern checks skipped on commit messages."
fi

The same patterns from ~/.claude/safe-push-blocklist that block diff content (step 2) ALSO block commit messages. Apply the full blocklist to BOTH title and body — not just the diff. For public repos, also flag:

• Personal info (email, phone, address) — categorical, not always pattern-matched
• Private repo names you own (e.g., upstream dev mirrors) — soft-warn, ask user before pushing
• Vague messages ("fix", "update", "wip") — suggest rewrites

If issues found, suggest interactive rebase to clean messages (with user approval).