Who Can Still Push to main? An Access and Process Audit in 30 Seconds
The question is not who has push access to main — that is an access-control question, answered in the platform's settings. The question this article answers is the behavioral one: who actually pushes to main, how often, and through what process, because the behavior is what the history records and the settings only constrain. The direct-push ratio from gitpulse is the headline metric: the…
The article addresses two main questions: who can push to the main branch, and how to audit the push process effectively. It emphasizes that the ability to push is an access-control issue, while the actual behavior of pushing and the resulting process are what matter. The key metric presented is the direct-push ratio, which measures the fraction of commits that land on main without a merge.
This ratio, along with its distribution by author, day, time, and trend, provides a more accurate picture of the push process than just the raw access levels.
The article details a three-command audit: calculating the ratio for the last quarter, splitting it by author, and comparing it to the ratio over the last month versus the quarter. The crucial finding is the gap between the documented review process and the actual commit behavior. If documentation states that all changes go through review, but the history shows a high direct-push ratio, the documentation is misleading. The article provides a set of commands to perform this audit and interpret the results.
The author also discusses the importance of understanding the broader context beyond just push access. This includes monitoring hotspot files with frequent commits, identifying unusual commit patterns (like late-night activity), and moving beyond simple commit counts to assess contributor impact based on lines changed, churn, and the breadth of code impacted.
The goal is to provide actionable insights rather than a mere compliance checklist, emphasizing the need for a practical, habit-driven approach rather than an abstract policy document.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
