From: Alessio Attilio <alessio.attilio@protonmail.com>

Introduce the 'hooks.allowNoVerify' configuration variable to control
whether the '--no-verify' (or '-n') command-line option is permitted
during operations executing client-side hooks (commit, push, merge,
rebase, am).

Client-side hooks execute in the user's local repository and cannot serve
as an authoritative security boundary; authoritative policy enforcement
belongs on the server (such as via pre-receive hooks). However,
developers often invoke '--no-verify' out of habit or muscle memory,
inadvertently skipping local checks.

To address concerns regarding false senses of security without breaking
legitimate emergency escape hatches, allow configuring the variable to
'true' (the default), 'warn', or 'false'. In 'warn' mode, Git permits
the bypass while emitting a warning to standard error, ensuring
visibility without interrupting urgent workflows.

When set to 'false', Git aborts execution and provides actionable advice
explaining that the setting is an ergonomic workflow guardrail. To avoid
trapping developers during broken hook scripts or critical hotfixes,
the guardrail can be overridden by passing '-c hooks.allowNoVerify=true'
or by setting the 'GIT_ALLOW_NO_VERIFY=1' environment variable. This
prevents developers from having to resort to destructive workarounds
such as removing hook files or clearing execute permissions.

Centralize the option verification logic across all affected commands into
validate_no_verify() in hook.c.

Signed-off-by: Alessio Attilio <alessio.attilio@protonmail.com>

Submitted-As: https://lore.kernel.org/git/pull.2215.v3.git.1788369794965.gitgitgadget@gmail.com
In-Reply-To: https://lore.kernel.org/git/pull.2215.git.1788365862670.gitgitgadget@gmail.com
In-Reply-To: https://lore.kernel.org/git/pull.2215.v2.git.1788366925041.gitgitgadget@gmail.com