When you enable pre-receive hook for git repository:
It takes no arguments, but for each ref to be updated it receives on standard input a line of the fo
I just did this. Here's the basic flow I used.
In your pre-receive hook, read each line from stdin, which (as you mentioned) look like this:
oldref newref refname
For each (oldref, newref) pair you need to list all the commits:
git show --format=format:%H --quiet oldref..newref
for each commit you need to list all the files:
git diff --name-only commit^..commit
to examine a file, use git show:
git show commit:filepath
do whatever checking of file contents here. If you want to notify the user of an issue, write to stderr
after iterating all the refs, commits and files exit nonzero to reject the push, or zero to allow it
Note that this approach walks all the commits in order, so if a file is modified in several commits each version will get examined. If you wanted to only view each file in a push once, traverse the commits in reverse order instead, and just don't examine a given file twice. I recommend the first approach however so that all versions of pushed files are examined.