* feat(policies): add tag push protection to GitHub policy
Add a `deny_tag_push` parameter (default `True`) to the GitHub
policy that blocks pushing tags to remotes via `git push --tags`,
`git push --follow-tags`, or explicit `refs/tags/` refspecs. Tags
are immutable references that downstream CI/CD and release tooling
depend on; an agent pushing a tag can trigger releases, deployments,
or break semver expectations.
Tag refspecs (`refs/tags/v1.0`) are also filtered out of the branch
set so they don't pollute `write_branches` checks.
The check fires before repo/branch gating so even a tag push to an
undeterminable remote alias is denied rather than surfaced as ASK.
Set `deny_tag_push=False` to let tag pushes through normal write
gating.
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
* style(policies): join tag-push deny message onto one line for ruff format
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
---------
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Yuan Tang
5798d74e5b