magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

whole-tree

A deny rule by default: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead.

What it catches

A whole-tree VCS reset, checkout, restore or clean, which cannot be undone.

Why

These destroy uncommitted and untracked work across the WHOLE tree, including a concurrent session's, and nothing recorded anywhere can give it back. It is the one category where an over-eager refusal is the safe direction, which is why an unparsable line falls back to the pattern rather than passing. Verify in place instead: no magus run needs a clean tree. git's own help passes, because git documents that it prints usage without running: git stash --help, git reset -h, git help stash. It has to be the whole line, with nothing between the verb and the flag, so git reset --hard --help, git -c ... stash --help, a VAR=value prefix, sh -c or a pipe are judged as work.

Default and override

By default this rule takes the decision deny. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"whole-tree": "advise"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [whole-tree]: ...

magus describe rule whole-tree prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

ReferencePages in this section. agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule by default: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. lease-vcs: a worker lease pushing, stashing or reverting, or committing outside its own branch and checkoutA deny rule by default: it refuses a worker lease pushing, stashing or reverting, or committing outside its own branch and checkout, and names what to run instead.
guardruleswhole-treedeny
Last updated (1a76274f)
Earlier changes on this page (2)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs: magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.