The text regex becomes a prefilter. The command is split into simple
commands by an awk tokenizer (quotes, escapes, ; && || | ( ) backticks,
heredoc bodies dropped) and a push is only a simple command whose argv[0]
is git (or */git) with push or send-pack as its first non-option word.
grep "git push", git log -S, git config --get push.default, git stash
push, heredocs and commit messages quoting a push are no longer denied.
bash|sh|zsh -c scripts are re-checked (depth 3); wrappers (sudo, env,
eval, xargs, timeout, git subtree...), assignments whose value reads as
a push, a missing awk or > 2000 simple commands keep the text verdict.
Prefilter also matches "git" push (quote characters stripped).
Suite 98 -> 124 checks.
bchanot
fe7d5cdb28