No force-push to main

Block git push --force (or -f) against protected branches (main, master, trunk, release/*). This is the most common irreversible destruction of public history.

When it fires#

When git push --force (or -f, or --force-with-lease without an explicit target) is invoked from any folder, and the resolved target branch is in the protected list.

Override#

For deliberate history rewrites (cleanup of accidentally-pushed secrets, branch rebase before merge), use nimblegate git --force-yes --reason="..." push --force ....