branchpol scans your remotes for naming and protection violations — wip, banned defaults, missing protection branches — reports them, and exits non-zero so CI blocks the merge.
$ branchpol check branchpol — origin · 14 branches scanned wip ✗ forbidden pattern: matches forbidden pattern ^wip$ TEMP-auth-retry ! case: should be lowercase (a-z, 0-9, . _ / -) 1 error(s), 1 warning(s) $ echo $? 1 ← CI fails the job
Branch conventions only work when something checks them on every push.
Require patterns like feat/* or release/*, forbid wip/master/deny-lists, enforce lowercase names and a max length.
Required branches must exist on the remote, banned branches must not, and the remote's default branch must match your policy.
Reads branches straight from the remote with read-only git plumbing. No checkout, no working-tree changes, safe anywhere.
Non-zero exit on violations, JSON output for tooling, and GitHub Actions annotations that show up inline on pull requests.
Flag tracking branches with no commits for 90+ days before they become someone's archaeology project.
Built on Node built-ins and the git CLI you already have. Install globally, run offline with --local, trust nothing else.
Three steps from "we should really fix our branches" to an enforced policy.
Creates a documented branchpol.config.json: required patterns, deny-lists, protected branches, staleness.
Lists every remote branch via read-only git commands and lints each one against your rules.
Violations fail the job — locally, in GitHub Actions (with inline annotations), or any CI that understands exit codes.
The CLI is free and MIT-licensed. Pay when you want organization-wide enforcement.
Runs on macOS, Linux and Windows. Requires Node 18+ and git.
$ npm install --global branchpol $ cd my-project && branchpol init $ branchpol check ✓ no policy violations
No. It's a local CLI that shells out to read-only git commands against whatever remote you configure. Nothing is uploaded anywhere.
No. Scanning uses git ls-remote and git for-each-ref — both strictly read-only. With --fetch it runs git fetch --prune, which only updates remote-tracking refs.
Fine. The core scan works with any git remote. Only the protect command emits GitHub-specific payloads.
The CLI is MIT. Branchpol Pro is a separate paid product.