[FEAT] Don't allow modification to internal reference

- This a port of https://github.com/go-gitea/gitea/pull/31931 in a
behavior-sense. None of the code was actually ported.
- Follow up for #2834, now also don't allow modification.
- Integration test added.
- Unit test modified.

3 files changed, 15 insertions, 2 deletions

diff --git a/cmd/hook.go b/cmd/hook.go
index edab611972..93dfd9d648 100644
--- a/cmd/hook.go
+++ b/cmd/hook.go
@@ -322,7 +322,8 @@ func runHookUpdate(c *cli.Context) error {
 		return fail(ctx, fmt.Sprintf("The deletion of %s is skipped as it's an internal reference.", refFullName), "")
 	}
 
-	return nil
+	// If the new comment isn't empty it means modification.
+	return fail(ctx, fmt.Sprintf("The modification of %s is skipped as it's an internal reference.", refFullName), "")
 }
 
 func runHookPostReceive(c *cli.Context) error {
diff --git a/cmd/hook_test.go b/cmd/hook_test.go
index 514eb917e1..1f0ee7087b 100644
--- a/cmd/hook_test.go
+++ b/cmd/hook_test.go
@@ -180,8 +180,15 @@ func TestRunHookUpdate(t *testing.T) {
 	})
 
 	t.Run("Update of internal reference", func(t *testing.T) {
+		defer test.MockVariableValue(&cli.OsExiter, func(code int) {})()
+		defer test.MockVariableValue(&setting.IsProd, false)()
+		finish := captureOutput(t, os.Stderr)
+
 		err := app.Run([]string{"./forgejo", "update", "refs/pull/1/head", "0a51ae26bc73c47e2f754560c40904cf14ed51a9", "0000000000000000000000000000000000000001"})
-		require.NoError(t, err)
+		out := finish()
+		require.Error(t, err)
+
+		assert.Contains(t, out, "The modification of refs/pull/1/head is skipped as it's an internal reference.")
 	})
 
 	t.Run("Removal of branch", func(t *testing.T) {
diff --git a/tests/integration/git_test.go b/tests/integration/git_test.go
index 2c46fdde68..b5afdd78c4 100644
--- a/tests/integration/git_test.go
+++ b/tests/integration/git_test.go
@@ -764,6 +764,11 @@ func doInternalReferences(ctx *APITestContext, dstPath string) func(t *testing.T
 		require.Error(t, gitErr)
 		assert.Contains(t, stdErr, fmt.Sprintf("remote: Forgejo: The deletion of refs/pull/%d/head is skipped as it's an internal reference.", pr1.Index))
 		assert.Contains(t, stdErr, fmt.Sprintf("[remote rejected] refs/pull/%d/head (hook declined)", pr1.Index))
+
+		_, stdErr, gitErr = git.NewCommand(git.DefaultContext, "push", "origin", "--force").AddDynamicArguments(fmt.Sprintf("HEAD~1:refs/pull/%d/head", pr1.Index)).RunStdString(&git.RunOpts{Dir: dstPath})
+		require.Error(t, gitErr)
+		assert.Contains(t, stdErr, fmt.Sprintf("remote: Forgejo: The modification of refs/pull/%d/head is skipped as it's an internal reference.", pr1.Index))
+		assert.Contains(t, stdErr, fmt.Sprintf("[remote rejected] HEAD~1 -> refs/pull/%d/head (hook declined)", pr1.Index))
 	}
 }