In GIT, how can I prevent people from changing or removing commits that have already been pushed?

Question

We recently had an intern run "git reset --hard" and accidentally undo a lot of work on our main GIT repo. We are in the process of recovering the work, but I want to make sure nothing like this ever happens again.

I know there are a lot of questions about this, but they all seem to be about recovering rather than prevention. Is there any way I can prevent pushes to our main repo that alter or remove commits that have already been pushed? Is there a config setting or maybe a push hook that will do the job?

Answer 1

There are 2 configuration options you can set on your central (bare) repo to help prevent this problem:

receive.denyNonFastForwards
receive.denyDeletes

The first option requires that all pushes add history only. A git reset followed by a git push would be denied.

The second closes a loop-hole where someone could delete a remote branch with git push <origin> :<branch-to-delete> and then push again with a normal git push and whatever changes they wanted.