What Validations Does no-mistakes Perform? A Complete Guide to Its Safety Checks

no-mistakes validates trusted configuration sources, repository branch states, and push operations to prevent data loss, unauthorized command execution, and race conditions in Git workflows.

The no-mistakes tool from kunchenguid/no-mistakes is a safety-first Git workflow orchestrator designed to protect repositories from common operational hazards. Before executing any pipeline step or allowing a pull request to advance, the system runs a comprehensive suite of validations spanning configuration integrity, repository state consistency, and runtime environment verification.

Trusted Configuration Validation

Pinned Commit SHA Verification

In internal/daemon/manager.go, the loadTrustedRepoConfig function ensures that configuration is only loaded from a pinned commit SHA on the default branch. If the fetch operation fails, the configuration is treated as empty and commands are disabled, preventing attackers from executing arbitrary code through unverified configuration changes.

The implementation resolves the default branch reference, fetches the file at that specific SHA, and unmarshals it only after verification:

// Example: Loading trusted config (internal/daemon/manager.go)
sha, err := git.ResolveRef(ctx, "origin/"+defaultBranch)
if err != nil {
    // Fetch failed → treat config as empty (commands disabled)
    return nil
}
cfgBytes, err := repo.ReadFileAtSHA(ctx, sha, ".no-mistakes.yaml")
if err != nil {
    // Config missing on default branch → safe default
    return nil
}
var cfg config.Config
yaml.Unmarshal(cfgBytes, &cfg)

Command Execution Restrictions

The allow_repo_commands setting in internal/config/config.go is only honored when defined in the trusted default-branch configuration. This prevents contributors from self-enabling arbitrary shell commands in untrusted branch configurations, effectively sandboxing command execution to verified sources.

Repository State Validations

Remote Branch Verification Before Rebase

Before rebasing, internal/pipeline/steps/rebase.go fetches both origin/<default> and origin/<branch> to ensure the operation targets the remote-tracking default branch rather than a stale local copy. The code specifically checks for un-pushed work on the local default branch through the detectBundledLocalDefaultCommits logic, preventing accidental inclusion of local commits into pull requests.

Detecting Bundled Local Default Commits

The validation compares the local default branch against its remote counterpart using git.ResolveRef. If the local default is ahead of the remote and the branch head is an ancestor of the local default, the system flags this as StatusNeedsApproval to prevent silent bundling of unpushed work:

// Example: Detecting bundled local default-branch commits (internal/pipeline/steps/rebase.go)
localDefault, _ := git.ResolveRef(ctx, "refs/heads/"+defaultBranch)
remoteDefault, _ := git.ResolveRef(ctx, "origin/"+defaultBranch)
if ahead(localDefault, remoteDefault) && isAncestor(branchHead, localDefault) {
    return pipeline.StepResult{
        Status: pipeline.StatusNeedsApproval,
        AutoFixable: false,
    }
}

Push Safety and Lease Guards

Force-Push Protection

The internal/pipeline/steps/forcepush.go implements a lease-guard mechanism that re-reads the remote head immediately before pushing. A force-push is only permitted if one of the following conditions is met:

• The branch is new
• The remote head matches the last-seen SHA
• All new remote commits are already present by patch-ID using git rev-list --cherry-pick

If these conditions fail, the system returns forcePushWouldDiscardError, preventing the push from discarding commits added by others after the run started:

// Example: Force-push lease guard (internal/pipeline/steps/forcepush.go)
lastSeenSHA, err := git.ResolveRef(ctx, "origin/"+branch)
// … fetch latest remote SHA …
remoteSHA, _ := git.ResolveRef(ctx, "refs/remotes/origin/"+branch)

// Fast-path: remote unchanged → safe to push
if remoteSHA == lastSeenSHA {
    return nil
}

// Otherwise ensure the new commits are already present by patch-ID
out, _ := exec.CommandContext(ctx, "git", "rev-list", "--cherry-pick",
    "--right-only", fmt.Sprintf("%s...%s", baseSHA, remoteSHA)).CombinedOutput
if len(out) == 0 {
    // No divergent commits → safe
    return nil
}
return fmt.Errorf("force-push would discard external work")

CI Auto-Fix Lease Validation

Similarly, internal/pipeline/steps/ci.go mirrors the force-push logic for CI-generated fixes. Before rebasing or pushing automated corrections, it validates that the remote tip has not advanced beyond the run's last-observed SHA. This ensures that CI-driven auto-fixes do not overwrite concurrent changes made by other developers.

Runtime Environment and Intent Verification

Executable Path Verification

Before invoking external tools, internal/shellenv/shellenv.go uses exec.LookPath to verify that required binaries (git, glab, gh, etc.) exist in the system PATH. This prevents opaque subprocess failures that could corrupt the workflow state or leave the repository in an inconsistent condition.

Intent Parsing and Validation

The internal/intent/summarizer.go validates the intent section of .no-mistakes.yaml, ensuring that regex patterns and allowed actions match expected formats before any pipeline step executes. This validation guarantees that the high-level purpose of a run aligns with repository policies.

Database and State Integrity

Run State Tracking

In internal/db/run.go and internal/pipeline/executor.go, the system sets awaiting_agent_since when a step encounters an approval gate, clearing it once the agent responds. This provides observability for supervisors monitoring runs paused for human or AI decisions, ensuring that stalled workflows are visible to operators.

Schema Constraints

internal/db/schema.go enforces NOT-NULL and foreign-key constraints for runs, steps, and rounds. These database-level validations guarantee internal state integrity across daemon crashes and restarts, preventing orphaned records or invalid state transitions.

Summary

• Trusted configuration loading ensures that only default-branch configurations at pinned commits control command execution, preventing supply-chain attacks.
• Branch-state validation verifies that rebases target remote-tracking branches and detects unpushed local work that could accidentally bundle into pull requests.
• Lease-guard validation for force-pushes and CI auto-fixes prevents overwriting commits added by others after a run begins.
• Runtime verification checks for required binaries and valid intent configurations before executing any workflow step.
• Database integrity constraints maintain consistent state across crashes and provide visibility into approval-gated runs.

Frequently Asked Questions

What happens if the trusted configuration fails to load?

If loadTrustedRepoConfig in internal/daemon/manager.go cannot resolve the default branch SHA or read the configuration file, the system treats the configuration as empty and disables command execution. This fail-safe prevents the daemon from running potentially malicious commands defined in unverified branch configurations.

How does no-mistakes prevent force-pushes from losing work?

The force-push validation in internal/pipeline/steps/forcepush.go implements a lease-guard that compares the current remote HEAD against the last-seen SHA. If new commits exist on the remote that are not present by patch-ID, the system returns a forcePushWouldDiscardError and aborts the operation, ensuring that concurrent commits by other developers are never silently overwritten.

Can contributors enable arbitrary shell commands in their branch configurations?

No. The allow_repo_commands setting is only honored when present in the trusted default-branch configuration as enforced in internal/config/config.go. This validation prevents contributors from enabling arbitrary shell execution through unverified configuration changes in their feature branches.

How does the system handle long-running CI checks without timing out?

The CI validation logic in internal/pipeline/steps/ci.go continuously monitors the remote tip and re-arms the timeout only when the upstream advances. This allows long-running CI processes to complete without hitting timeout limits, while still validating that the remote state has not changed in a way that would invalidate the auto-fix.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}