From 5dd675d07fd3c8877571ebb4434765e831302f09 Mon Sep 17 00:00:00 2001
From: Bill Seremetis <bill@seremetis.net>
Date: Mon, 23 Mar 2026 10:13:21 +0200
Subject: [PATCH] pre-push verification when pushing directly to production

---
 scripts/git-hooks/pre-push | 42 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/scripts/git-hooks/pre-push b/scripts/git-hooks/pre-push
index ce2f37f..58cb2bc 100755
--- a/scripts/git-hooks/pre-push
+++ b/scripts/git-hooks/pre-push
@@ -59,4 +59,46 @@ if [ -f "tests/backstop/backstop.json" ] && [[ "$CURRENT_BRANCH" != "dev" ]]; th
   fi
 fi
 
+# ── Main/master branch protection ───────────────────────────────────────────
+if [[ "$CURRENT_BRANCH" == "main" || "$CURRENT_BRANCH" == "master" ]]; then
+  echo ""
+  echo "=================================================================================================="
+  echo "⚠️  You are about to push directly to '$CURRENT_BRANCH'."
+  echo "=================================================================================================="
+  echo ""
+  read -p "Are you sure you want to push to '$CURRENT_BRANCH'? (type 'yes' to confirm): " main_confirm </dev/tty
+  if [[ "$main_confirm" != "yes" ]]; then
+    echo "🚫 Push aborted."
+    exit 1
+  fi
+
+  # Offer backup if upstream is platform/upsun
+  UPSTREAM_PROVIDER=""
+  ENV_FILE="$(git rev-parse --show-toplevel)/.ddev/.env.anner"
+  if [ -f "$ENV_FILE" ]; then
+    UPSTREAM_PROVIDER=$(grep -E '^DDEV_UPSTREAM_PROVIDER=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2 | tr -d '"')
+  fi
+
+  if [[ "$UPSTREAM_PROVIDER" == "platform" || "$UPSTREAM_PROVIDER" == "upsun" ]]; then
+    echo ""
+    read -p "Create a backup of the '$CURRENT_BRANCH' environment on ${UPSTREAM_PROVIDER}? (Y/n): " backup_confirm </dev/tty
+    backup_confirm=${backup_confirm:-Y}
+    if [[ "$backup_confirm" =~ ^[Yy] ]]; then
+      echo "⏳ Creating backup..."
+      ddev exec upsun backup -e "$CURRENT_BRANCH"
+      if [[ $? -ne 0 ]]; then
+        echo ""
+        read -p "⚠️  Backup failed. Continue pushing anyway? (y/N): " backup_fail_confirm </dev/tty
+        backup_fail_confirm=${backup_fail_confirm:-N}
+        if [[ ! "$backup_fail_confirm" =~ ^[Yy] ]]; then
+          echo "🚫 Push aborted."
+          exit 1
+        fi
+      else
+        echo "✅ Backup created."
+      fi
+    fi
+  fi
+fi
+
 exit 0