How `detectBundledLocalDefaultCommits` Prevents Forwarding Unpushed Commits in no-mistakes

The detectBundledLocalDefaultCommits function blocks the rebase pipeline when a feature branch contains commits from the local default branch that have never been pushed to the remote, preventing accidental bundling of unrelated work into pull requests.

The no-mistakes repository implements strict safety guards to ensure clean Git workflows. The detectBundledLocalDefaultCommits function serves as a critical checkpoint within the rebase step, analyzing branch ancestry to stop unintentional forwarding of local-only commits. This guard runs automatically before any rebase operation in internal/pipeline/steps/rebase.go, ensuring that only commits already present on the remote default branch are considered safe to replay.

The Detection Algorithm in internal/pipeline/steps/rebase.go

The detectBundledLocalDefaultCommits function executes a ten-stage validation pipeline to identify potentially dangerous commit bundling. Each stage validates a specific condition before allowing the rebase to proceed.

Early Exit Conditions

The function first filters out irrelevant scenarios to avoid false positives. If the current branch is the default branch itself, or if no working repository path exists in the step context (sctx.Repo.WorkingPath), the function returns nil immediately, indicating no finding. This prevents the guard from triggering on the main branch or in invalid repository states.

Reference Resolution and Validation

Once past the initial filter, the function resolves critical Git references. It executes git rev-parse in the working clone to obtain the SHA of refs/heads/<default> (the local default branch tip). Simultaneously, it verifies that origin/<default> exists in the pipeline's work-tree (sctx.WorkDir). If the remote reference cannot be resolved, the guard exits. The function also confirms that the local tip commit exists in the object store, which is required for subsequent reachability checks.

Ancestry Verification

The guard performs two critical ancestor checks to determine if bundling is possible:

1. Already pushed check: If the local tip is an ancestor of origin/<default>, the default branch has been fully pushed and no local work exists to bundle. This provides a fast-path return of nil.

2. Branch inclusion check: Using isAncestor(localTip, "HEAD"), the function verifies that the current branch actually contains the local default tip. If the branch does not carry this commit, the default-branch work is unrelated to the current branch, and the guard returns nil.

Commit Enumeration and Impact Analysis

When the local tip is neither pushed nor unrelated, the guard extracts the problematic commits. It runs git log to list all commit messages between origin/<default> and the local tip. If this log is empty, the function exits. Otherwise, it executes git diff --name-only to identify the set of files touched by these unpushed commits, using the first file as a representative location for the finding report.

Pipeline Integration and Blocking Behavior

The RebaseStep.Execute method calls detectBundledLocalDefaultCommits before attempting any rebase operation. If the function returns a non-nil pipeline.StepOutcome, the step returns immediately, halting the entire pipeline.

The blocking outcome is constructed with specific fields that require human intervention:

• NeedsApproval: true – Forces the pipeline to pause for manual review
• AutoFixable: false – Prevents automatic resolution
• Detailed description including commit count, file count, and remediation instructions

This integration ensures that only commits present on the remote default branch are rebased, while any local unpushed work surfaces as a warning requiring explicit user action.

Practical Examples

Guard Integration in the Rebase Step

// Inside RebaseStep.Execute (internal/pipeline/steps/rebase.go)
if outcome := detectBundledLocalDefaultCommits(ctx, sctx, branch, defaultBranch); outcome != nil {
    // The branch carries unpushed default-branch commits → stop here.
    return outcome, nil
}

User-Facing Warning Output

When the guard triggers, users see output similar to:

⚠️  branch bundles 2 unpushed main commit(s)
branch carries 2 commit(s) that exist on your local main branch but were never pushed to origin/main; rebasing would bundle this unrelated work (3 file(s)) into the PR:
- abc1234 Fix typo in README
- def5678 Add experimental feature
Push main to origin, or rebase your branch onto origin/main, before gating.

Resolving a Blocked State

To clear the finding and proceed with gating:

# In the contributor's local repo

git push origin main               # publish the default-branch work

git checkout feature-branch
git rebase origin/main             # rebase onto the fresh remote default

# Now run no-mistakes again; the guard will return nil.

Summary

• detectBundledLocalDefaultCommits runs at the start of the Rebase step in internal/pipeline/steps/rebase.go to prevent forwarding unpushed commits.
• The function performs ancestor checks using isAncestor to determine if local default branch commits have been pushed or if they belong to the current branch.
• It extracts commit messages and affected files using git log and git diff --name-only to build a detailed blocking report.
• When triggered, it returns a pipeline.StepOutcome with NeedsApproval: true and AutoFixable: false, forcing manual intervention.
• Users must push their default branch or rebase onto origin/<default> to clear the guard and continue the pipeline.

Frequently Asked Questions

What triggers detectBundledLocalDefaultCommits to block a rebase?

The guard blocks when a feature branch contains commits that exist on the local default branch (e.g., main) but are not ancestors of origin/main. Specifically, when isAncestor(localTip, "HEAD") returns true but isAncestor(localTip, "origin/main") returns false, the function identifies unpushed commits that would be inadvertently rebased into the pull request.

How does detectBundledLocalDefaultCommits differ from other safety guards in no-mistakes?

While complementary guards like those in internal/pipeline/steps/forcepush.go prevent clobbering unseen upstream commits, detectBundledLocalDefaultCommits specifically prevents bundling unrelated local work into a PR. It focuses on the provenance of commits relative to the local versus remote default branch, whereas other guards focus on force-push safety and upstream synchronization.

Can I bypass the detectBundledLocalDefaultCommits check?

No, the guard is mandatory within the Rebase step execution flow. Because the function returns a blocking StepOutcome that propagates to the pipeline runner, there is no automatic bypass mechanism. Users must resolve the underlying condition by either pushing the default branch commits to the remote or rebasing the feature branch onto the updated remote default branch.

Which Git commands does detectBundledLocalDefaultCommits use internally?

The function relies on several Git operations provided through the git.Run helper (indirectly via internal/git/run.go): git rev-parse to resolve local and remote refs, git log to enumerate unpushed commits, and git diff --name-only to identify affected files. These commands execute within the working directory context (sctx.WorkDir) to ensure accurate path resolution.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}