XonqNopp [off-list ref] writes:
I have discovered some months ago that it is more safe to force a push with
git push --force-with-lease
But since then I keep wondering: why is this not the default?
Because the form "--force-with-lease=<this-exact-commit>" is a
strict improvement over "--force", but the lazy "guess where the
other end should be" form, i.e. "--force-with-lease" alone, is worse
than "--force" in that it gives users false sense of security
without offering the safety the "lease" mechanism gives.
Hi,
On Tue, 2 Mar 2021, Junio C Hamano wrote:
XonqNopp [off-list ref] writes:
quoted
I have discovered some months ago that it is more safe to force a push with
git push --force-with-lease
But since then I keep wondering: why is this not the default?
Because the form "--force-with-lease=<this-exact-commit>" is a
strict improvement over "--force", but the lazy "guess where the
other end should be" form, i.e. "--force-with-lease" alone, is worse
than "--force" in that it gives users false sense of security
without offering the safety the "lease" mechanism gives.
To add to that: some tools helpfully fetch in the background, therefore
remote-tracking branches are updated _without_ the user being aware of it.
In this instance, `--force-with-lease` is very dangerous.
We did introduce the `--force-if-includes` option, but it seems that we
made this option _not_ imply `--force-with-lease`, which makes it an
unwieldy `git push --force-with-lease --force-if-includes <refspec>`,
which admittedly not even _I_ type, and I really would benefit from this
option.
Maybe it is time to admit that `--force-if-includes` should imply
`--force-with-lease`, and then add `-F` as a shortcut?
Ciao,
Johannes
Because the form "--force-with-lease=<this-exact-commit>" is a
strict improvement over "--force", but the lazy "guess where the
other end should be" form, i.e. "--force-with-lease" alone, is worse
than "--force" in that it gives users false sense of security
without offering the safety the "lease" mechanism gives.
That seems like a case of the perfect being the enemy of the good.
Generaly, "force with lease" is a better behaviour than "force". It will not catch all usage errors, but it will catch lots: again last week colleagues had issues which would had been caught by caught by using "--force-with-lease" instead" of "-f", but of course "-f" is "the default" in rebase-based workflows, what with being so short and sweet.
I found XonqNopp's proposal as I was planning to post a similar message, though stricter: I don't think `--force` deserves a short form at all, I believe `-f` should be progressively migrated over to alias to `force-with-lease` as it's a significantly better default behaviour, and the odd *need* for `--force` (of which I can't personnally remember one) can be typed out in its entirety.
For the vast majority of users, all it will do is catch genuine errors. For a small minority it will have no effect[0]. And for an infinitesimal number it will be unhelpful as `--force` without lease or inclusion is genuinely what they were looking for.
I genuinely do not understand what `force-if-includes` does from reading the manpage and just learned that it exists from Johannes Schindelin's message, it might be an even better default behaviour for `-f`.
Either way I think `-f` should not, ultimately, alias to `--force`.
My idea there was to introduce a setting initially defaulting to `false` and a warning about the migration (triggered on `-f` when that setting is unset), then a few versions later flip the default to `true`.
[0] and I would expect users of tools which helpfully fetch in the background to not be using the CLI, and thus not be impacted by this change.