guanghu-ice-heart/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive

#!/bin/sh
set -eu

# The code-channel service runs with UMask=0077. Keep that isolation for its
# database and other state, but make Git objects and refs readable/writable by
# the repository's dedicated shared group after an accepted public push.
cat >/dev/null
repo_dir=$(git rev-parse --absolute-git-dir)
expected_repo=/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git
[ "$repo_dir" = "$expected_repo" ] || exit 0
cd "$repo_dir"
owner_uid=$(id -u)

share_tree() {
  # RestrictSUIDSGID forbids chmod calls that preserve a setgid directory.
  # Existing shared directories are already traversable, so touch only new
  # private directories and use a numeric mode that drops the special bit.
  find "$1" -user "$owner_uid" -type d ! -perm -g=x -exec chmod 0770 {} +
  find "$1" -user "$owner_uid" -type f ! -perm -g=r -exec chmod g+r {} +
}

share_tree "$repo_dir/objects"
share_tree "$repo_dir/refs"

# receive-pack may keep new objects in a quarantine directory until hooks have
# completed. Normalize that directory before Git moves the objects into place.
if [ -n "${GIT_OBJECT_DIRECTORY:-}" ] && [ -d "$GIT_OBJECT_DIRECTORY" ]; then
  case "$GIT_OBJECT_DIRECTORY/" in
    "$repo_dir/"*) share_tree "$GIT_OBJECT_DIRECTORY" ;;
  esac
fi

for shared_file in HEAD packed-refs; do
  if [ -f "$repo_dir/$shared_file" ]; then
    find "$repo_dir/$shared_file" -user "$owner_uid" -exec chmod g+rw {} +
  fi
done

printf '%s\n' "post_receive_permissions_reconciled" >"$repo_dir/hooks/post-receive-share.last"