git-setup riglet: default deny rules

Author: YPares

riglets/git-setup.nix

@@ -3,6 +3,7 @@ self:
   config,
   pkgs,
   riglib,
+  lib,
   ...
 }:
 {
@@ -11,6 +12,15 @@ self:
   config.riglets.git-setup = {
     tools = [ pkgs.git ];
 
+    # Default set of deny rules for git usage
+    # Using mkDefault means end users of this riglet will be able to override this
+    denyRules.git = lib.mkDefault [
+      "reset"
+      "pull"
+      "push"
+      "commit --amend"
+    ];
+
     meta = {
       description = "Git setup with agent-identity";
       intent = "base";
@@ -35,15 +45,15 @@ self:
 
     promptCommands = {
       healthcheck = {
+        description = "Git healtcheck";
         template = ''
           Perform a git healthcheck to make sure everything is in order:
           - Check that remotes are fetcheable
           - Check that no oversized file is currently under version control (unless git-lfs is properly in place)
           - Check that no commit is left dangling
 
-          If not, reports problems and suggest solutions to the user
+          If not, report problems and suggest solutions to the user
         '';
-        description = "Git healtcheck";
       };
     };
   };