fix(guard): scope new-branch history scans to remote refs

[solomonneas]

Summary

• Scope new-branch history scans to commits not reachable from refs advertised by the push destination.
• Add --revs-stdin so the hook can send an exact commit set to one history scanner process without putting revisions on the command line.
• Keep the seeded hook compatible with macOS Bash 3.2 and report Git plumbing failures separately from leak verdicts.

Root cause

Git sends an all-zero remote SHA when a branch does not exist at the destination. The hook treated the local tip as the full history range, so it could scan and block content already published through another remote ref. Local remote-tracking refs cannot supply a safe exclusion set because they may be stale.

The hook now reads the destination URL passed by Git, enumerates its live refs, preserves peeled annotated-tag commits, and subtracts every advertised commit that is available locally. Missing remote objects are ignored safely. The remaining full SHAs are validated and sent on stdin to the history scanner.

This is also a follow-up to #82: Git enumeration and scanner failures still block the push, but the hook no longer labels those failures as found violations.

Verification

• ./scripts/verify: 4,730 passed, 3 skipped, 82.90% coverage.
• Focused guard and hook suite: 49 passed.
• shellcheck src/brigade/templates/hooks/pre-push
• Staged in-house content scan and commit-message scan.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a6c736f-cbcc-47db-97ef-57327f0efb75

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-pre-push-new-branch-range-brigade

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}