[PATCH v4 1/2] push: check pushed ref for --force-if-includes
From: Tyler Cipriani <hidden>
Date: 2026-09-14 04:00:43
Subsystem:
the rest · Maintainer:
Linus Torvalds
"--force-if-includes" ensures, "tip of the remote-tracking ref is
reachable from one of the 'reflog' entries of the local branch."
But check_if_includes_upstream() uses the local per-branch reflog based
on the destination branch rather than the branch being pushed; using
ref->name vs. ref->peer_ref->name.
For example, this command looks at the reflog for main vs. src, even
though src is being pushed:
git push --force-if-includes --force-with-lease origin src:main
This can cause confusing rejections or unintended data loss.
False rejections: when src is up-to-date with the tip of origin's main,
but main is out-of-date or nonexistent, then the force-if-includes check
will fail, telling users the remote ref has been updated since the last
checkout.
Data loss: when src is an orphan/out-dated branch, but main is
up-to-date, then the force-if-includes check will allow the push,
clobbering the remote main.
Instead, use ref->peer_ref to locate a branch with a reflog. But if ref
does not resolve to a branch (e.g., a detached HEAD, a tag, an oid),
then we reject the push. The alternative would be to use HEAD's reflog,
which is too broad to tell us if the history being pushed includes the
tip of the remote. We need a per-branch reflog, which means that pushes
of a ref that do not resolve to a branch are rejected. Rejecting the
push of a ref like a detached HEAD already happens today (if the
same-named local branch lacks the remote tip); now the detached HEAD and
other non-branch pushes are explicitly rejected.
Allow deletions, e.g.:
git push --force-if-includes --force-with-lease origin :main
A deletion has no source ref, so no branch reflog can be checked.
Existing tests already enforce that deletions should work with
force-if-includes.
ref->deletion is set after apply_push_cas (which triggers
check_if_includes_upstream). The ref->peer_ref name is "(delete)".
Instead check with is_null_oid to detect and allow deletion.
The early return when peer_ref is missing in check_if_includes_upstream
is necessary because apply_push_cas walks every advertised ref whenever
use_tracking_for_rest is set (i.e., a bare --force-with-lease), so
check_if_includes upstream is called for for refs that are not part of
the push.
Remove unnecessary check for empty return from get_local_ref, since it
never returns NULL for a non-empty name.
Reported-by: Stefan Haller <redacted>
Reported-by: D. Ben Knoble <redacted>
Signed-off-by: Tyler Cipriani <redacted>
---
remote.c | 26 +++++++++++++--
t/t5533-push-cas.sh | 81 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 105 insertions(+), 2 deletions(-)
diff --git a/remote.c b/remote.c
index 00723b385e..887c7ec00c 100644
--- a/remote.c
+++ b/remote.c@@ -2806,10 +2806,32 @@ static int is_reachable_in_reflog(const char *local, const struct ref *remote) */ static void check_if_includes_upstream(struct ref *remote) { - struct ref *local = get_local_ref(remote->name); - if (!local) + struct ref *local; + const char *name; + + /* ref without peer_ref will not be pushed */ + if (!remote->peer_ref) return; + /* A deletion has no local history to check against. */ + if (is_null_oid(&remote->peer_ref->new_oid)) + return; + + name = refs_resolve_ref_unsafe(get_main_ref_store(the_repository), + remote->peer_ref->name, + RESOLVE_REF_READING, NULL, NULL); + + /* + * if we resolve the ref to anything other than a branch, + * then there is no reliable reflog to check + */ + if (!name || !starts_with(name, "refs/heads/")) { + remote->unreachable = 1; + return; + } + + local = get_local_ref(name); + if (is_reachable_in_reflog(local->name, remote) <= 0) remote->unreachable = 1; free_one_ref(local);
diff --git a/t/t5533-push-cas.sh b/t/t5533-push-cas.sh
index cba26a872d..265be6a84c 100755
--- a/t/t5533-push-cas.sh
+++ b/t/t5533-push-cas.sh@@ -396,4 +396,85 @@ test_expect_success '"--force-if-includes" should allow deletes' ' ) ' +test_expect_success '"--force-if-includes" should allow forced update when using differently named branches' ' + setup_src_dup_dst && + test_when_finished "rm -fr dst src dup" && + ( + cd src && + git fetch && + git switch -c newbranch origin/main && + git rebase HEAD --onto HEAD^ && + git push --force-if-includes --force-with-lease origin newbranch:main + ) +' + +test_expect_success '"--force-if-includes" should allow forced update from HEAD' ' + setup_src_dup_dst && + test_when_finished "rm -fr dst src dup" && + ( + cd src && + git fetch && + git switch -c newbranch origin/main && + git rebase HEAD --onto HEAD^ && + git push --force-if-includes --force-with-lease origin HEAD:main + ) +' + +test_expect_success '"--force-if-includes" should reject forced update from differently named branches when local lacks remote ref' ' + setup_src_dup_dst && + test_when_finished "rm -fr dst src dup" && + ( + cd src && + git fetch && + git switch main && + git reset --hard origin/main && + git switch --orphan orphan && + test_commit I && + test_must_fail git push --force-with-lease --force-if-includes origin orphan:main + ) +' + +test_expect_success '"--force-if-includes" should reject forced update from HEAD when it lacks remote ref' ' + setup_src_dup_dst && + test_when_finished "rm -fr dst src dup" && + ( + cd src && + git fetch && + git switch main && + git reset --hard origin/main && + git switch --orphan orphan && + test_commit I && + test_must_fail git push --force-with-lease --force-if-includes origin HEAD:main + ) +' + +test_expect_success '"--force-if-includes" should reject forced update from detached HEAD' ' + setup_src_dup_dst && + test_when_finished "rm -fr dst src dup" && + ( + cd src && + git fetch && + git switch main && + git reset --hard origin/main && + git switch -c newbranch origin/main && + git checkout HEAD^ && + test_must_fail git push --force-if-includes --force-with-lease origin HEAD:main + ) +' + +test_expect_success '"--force-if-includes" should reject forced update from tag' ' + setup_src_dup_dst && + test_when_finished "rm -fr dst src dup" && + ( + cd src && + git fetch && + git switch main && + git reset --hard origin/main && + git switch -c newbranch origin/main && + git checkout HEAD^ && + git tag stable && + test_must_fail git push --force-if-includes --force-with-lease origin stable:main + ) +' + test_done
--
2.47.3