docs: 收编 git-push-dlp skill（DLP 保护区内 git push 流程）

2026-07-31 17:59:19 +08:00
parent 65b277fc72
commit e0f1db75c2
3 changed files with 160 additions and 0 deletions
@@ -0,0 +1,81 @@
+@echo off
+rem ==========================================================================
+rem git_push_dlp.bat
+rem Push from a DLP-protected (transparent-encrypted) directory where
+rem "git push" fails with: fatal: not a git repository
+rem
+rem How it works:
+rem   1. xcopy .git to a stage dir under %TEMP% (outside the protected zone,
+rem      an authorized process reads plaintext, no re-encryption outside).
+rem   2. Run "git push" from the stage dir.
+rem   3. Run "git fetch" in the original repo to sync remote-tracking refs.
+rem
+rem Usage (run inside the repo root):
+rem   git_push_dlp                      = git push origin HEAD
+rem   git_push_dlp origin main          = git push origin main
+rem   git_push_dlp upstream main:main   = any normal push args
+rem
+rem Env vars:
+rem   GIT_PUSH_DLP_WITH_LFS=1           = also copy .git\lfs (needed only when
+rem                                       the push contains new LFS objects)
+rem ==========================================================================
+setlocal EnableExtensions EnableDelayedExpansion
+chcp 65001 >nul
+
+if not exist ".git\" (
+    echo [ERROR] .git not found. Run this inside a git repository root.
+    exit /b 1
+)
+
+for %%I in ("%CD%") do set "REPO_NAME=%%~nxI"
+set "STAGE=%TEMP%\git_push_dlp\%REPO_NAME%-%RANDOM%%RANDOM%"
+
+echo [DLP] Stage dir: %STAGE%
+
+rem .git\lfs is the LFS object cache (often several GB); normal commits do
+rem not need it for push. Excluding it avoids xcopy disk-space failures.
+rem If this push contains new/changed LFS files, set GIT_PUSH_DLP_WITH_LFS=1 first.
+set "EXCLUDE_OPT="
+if not defined GIT_PUSH_DLP_WITH_LFS (
+    set "EXCLUDE_FILE=%TEMP%\git_push_dlp_exclude.txt"
+    > "!EXCLUDE_FILE!" echo \lfs\
+    set "EXCLUDE_OPT=/EXCLUDE:!EXCLUDE_FILE!"
+    echo [DLP] Excluding .git\lfs ^(set GIT_PUSH_DLP_WITH_LFS=1 to include^)
+)
+
+xcopy /E /I /Q /H /Y %EXCLUDE_OPT% ".git" "%STAGE%\.git" >nul
+if errorlevel 1 (
+    echo [ERROR] xcopy .git failed.
+    exit /b 1
+)
+
+set "REMOTE=%~1"
+if not defined REMOTE set "REMOTE=origin"
+if "%REMOTE:~0,1%"=="-" set "REMOTE=origin"
+
+set "PUSHARGS=%*"
+if not defined PUSHARGS set "PUSHARGS=origin HEAD"
+
+pushd "%STAGE%"
+echo [DLP] Run: git push %PUSHARGS%
+git push %PUSHARGS%
+set "EXIT_CODE=%ERRORLEVEL%"
+popd
+
+if not "%EXIT_CODE%"=="0" (
+    echo [ERROR] push failed with exit code %EXIT_CODE%
+    rmdir /s /q "%STAGE%" 2>nul
+    exit /b %EXIT_CODE%
+)
+
+echo [DLP] Sync back: git fetch %REMOTE%
+git fetch %REMOTE%
+set "FETCH_CODE=%ERRORLEVEL%"
+
+rmdir /s /q "%STAGE%" 2>nul
+if not "%FETCH_CODE%"=="0" (
+    echo [WARN] push succeeded but fetch back failed with exit code %FETCH_CODE%
+    exit /b %FETCH_CODE%
+)
+echo [DLP] Done.
+exit /b 0