Adds a check-no-force-push pre-push hook that detects and blocks git push --force / git push -f by inspecting pushed ref ancestry via git merge-base --is-ancestor.

Detection logic

Reads git's pre-push stdin (<local ref> <local sha> <remote ref> <remote sha>) and evaluates:

• Remote SHA is zero → new branch push → ✅ pass
• git merge-base --is-ancestor <remote_sha> <local_sha> returns 0 → fast-forward → ✅ pass
• Returns 1 → remote not in local ancestry → force push → ❌ fail
• Returns 128 → git error / unknown SHA → ✅ pass (conservative)

New components

• ForcePushValidator (engine.py) — core validator reading pre-push stdin
• PUSH_RULES (rules_catalog.py) — new push rule catalog, parallel to COMMIT_RULES/BRANCH_RULES
• [push] config section — allow_force_push = false to enable blocking via cchk.toml or CCHK_ALLOW_FORCE_PUSH env var
• validate_push() (api.py) — programmatic API entry point
• check-no-force-push (.pre-commit-hooks.yaml) — pre-push hook definition with stages: [pre-push]

Usage

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/commit-check/commit-check
    rev: vX.Y.Z
    hooks:
      - id: check-no-force-push

Or via CLI directly (e.g. in a custom pre-push script):

git push | commit-check --no-force-push

Or opt-in via config:

# cchk.toml
[push]
allow_force_push = false