magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

shared-stash

A deny rule by default: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead.

What it catches

A bare stash push or pop, on a stack every worktree shares.

Why

The stash stack is shared across every worktree of a repository, so a bare pop can take an entry another session pushed, and a bare push can bury one. Prefer a temporary commit to set work aside. If you must stash, push with a unique -m tag, capture your entry's SHA, and restore with apply <sha> rather than pop.

Default and override

By default this rule takes the decision deny. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"shared-stash": "advise"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [shared-stash]: ...

magus describe rule shared-stash prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

ReferencePages in this section. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refusedA deny rule by default: it refuses a push at a commit with no green gate: the person is asked, a leased worker refused, and names what to run instead. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule by default: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead.
guardrulesshared-stashdeny
Last updated (1a76274f)
Earlier changes on this page (1)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs: magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

Placeholders

Angle brackets mark a value you replace with your own; never type the brackets:

magus run <target>
magus completion <shell>    # e.g. bash, zsh, fish

<target>, <path>, <shell>, <name> and the like are stand-ins, not literal text.