feat(rules): add repo_has_commits condition for the empty-repo case

[CryptoJones]

Why

A branch + PR presupposes a base to diff against. An initial commit into an
empty repo has none, so no-direct-push-public-main denied a push that had no
alternative route — the only way to create the base branch is the push being
blocked.

Hit for real today: a new public repo could not take its own first commit. The
available workaround was to add the repo to except_repos, which has to be
repeated for every new project and grants a permanent exemption to buy a
one-time need.

What

A repo_has_commits condition, so the deny can be narrowed to repos that
actually have history worth protecting:

when:
  repo_visibility: public
  branch: [main, master]
  repo_has_commits: true    # only deny once there IS history

Absent, nothing changes — existing rules keep their current behaviour.

Two decisions worth review

It reads the remote, not the local checkout. A push is always preceded by a
local commit, so a local probe reports "has commits" every time and the empty
case can never be observed. The probe is deliberately uncached: a repo goes
from empty to non-empty exactly once, and that single transition is the entire
point, so a stale entry would keep granting the exemption after the first
commit landed.

It fails safe, opposite to repo_visibility. Visibility fails open to
avoid denying on a condition that could not be checked. Here an undeterminable
remote must never widen an exemption, so unknown is treated as satisfying the
condition and the deny stands. Fail-open is wrong wherever a condition narrows
a deny rather than widening one.

Non-boolean values are rejected rather than coerced — a quoted "true" is a
string and would read as truthy, and a block that silently flips a deny is
worse than one that is skipped and reported.

Tests

9 added, tests/test_rules.py 20/20 green. Both branches of the condition, the
fail-safe path, boolean validation, format_rules output, and the probe itself
against a real local bare remote with a commit present locally but not yet
pushed — the exact shape that makes a local-only check useless.

One test pins the behaviour that makes a typo dangerous: an invalid block does
not replace the seed rule, so the guard stays armed rather than silently
vanishing. That assertion was written after my first version of the test got it
backwards and the suite caught me.

Verification

• tests/test_rules.py: 20 passed
• Full suite: 1022 passed, 1 skipped, 5 pre-existing failures in
  tests/test_server.py — confirmed identical on unmodified origin/main
  (1d2eac8) in a clean worktree, so they are not from this change
• ruff check clean, ruff format applied

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: df34f0d8-64a8-476f-84e5-76823141a3b9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}