Contents
What gitta watches and what it blocks
gitta stops work on the routes that go through its checks. Branch protection decides which routes exist, so you can send every change through one of them.
Work that reached main
Work can reach main by a local git merge, a merged pull request or a push. gitta checks each agent's work against main as it is when that agent merges. When new code of an agent calls something that changed on main, gitta writes a note to .gitta/gitta.log, and the tests at merge time decide. A failed merge shows the new definition on main. A security control removed on main reaches the agents whose new code calls the code it protected, as a security warning at their next step.
Blocking routes
| Route | What stops bad work |
|---|---|
git merge, git pull, git push | The git hooks that gitta init adds run your gate on the combined code before main moves, and stop the merge when the tests fail. This also applies when a merge stopped on a conflict and is finished with git commit. --no-verify skips them, and the audit trail records it. |
| Pull request | The gitta check fails when the pull request breaks together with another open pull request. It blocks the merge only when branch protection requires it. |
| Push from a machine without gitta | No check runs there. The next merge on a machine with gitta runs the tests on code that includes it. |
Security controls on each route
When an agent removes or switches off a security control, such as a login check, gitta handles it like this:
| Route | What happens |
|---|---|
| Agent session | The agent that removed the control and each agent whose new code calls the code it protected get a security warning at their next step. |
git merge, git pull, git push | Reported in the output, .gitta/gitta.log and the audit trail. With weakened_checks set to block, the merge stops. |
| Pull request | The gitta check adds a Security line to its comment, and a security field to its JSON result. |
| Push from a machine without gitta | Not stopped. Agents whose new code relies on the control get a security warning. |
Make the checks mandatory
To send every change through a check, use your Git host's branch protection.
- Add the gitta check to your CI.
- On GitHub, open the repository settings and add a branch protection rule, or a ruleset, for
main. - Require a pull request before merging.
- Require status checks to pass, and select the gitta check.
- Do not allow bypass, or allow it only for a small group of people.
With these rules, direct pushes to main are refused. Agents and people then merge through a pull request, which goes through the check. GitLab has protected branches and merge request approvals. Azure Repos has branch policies with build validation.