Add pre-receive hook that blocks binary files

The documentation[1] says that the ‘--numstat’ option for ‘git diff’ will
display ‘-’ for both added and deleted lines for binary files. This script uses
that to detect that binary files are being pushed and will reject them.

This is naive and simplistic. ‘git diff’ shows the same output when binary files
are deleted (or replaced with git-lfs placeholders), so this would prevent us
from fixing errors. But for now it helps us prevent accidental submissions of
binary files.

[1]: man 1 git-diff

build/git-pre-receive-hook

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+block_push=0
+
+while read -r old new refname; do
+    while read -r added deleted filename; do
+        if [[ "$added" == "-" && "$deleted" == "-" ]]; then
+            block_push=1
+            echo "ERROR: ${filename} is a binary file."
+        fi
+    done < <(git diff --numstat "${old}..${new}")
+
+    if [[ $block_push -eq 1 ]]; then
+        echo "The ref '${refname}' has been rejected"
+    fi
+done
+
+if [[ $block_push -eq 1 ]]; then
+    echo "Binary files blocked. Please use git-lfs to push to this repo."
+    exit 1
+fi