Merge branch 'po-ref-hook-middleware' into 'master'

Enforce ref hook option in all relevant subcommands

Closes #2963

See merge request gitlab-org/gitaly!2713

58 files changed, 359 insertions, 220 deletions

diff --git a/internal/git/hooks.go b/internal/git/hooks.go
index 0629d052d..97099b859 100644
--- a/internal/git/hooks.go
+++ b/internal/git/hooks.go
@@ -51,20 +51,6 @@ func refHookEnv(ctx context.Context, repo *gitalypb.Repository, cfg config.Cfg)
 	}, nil
 }
 
-type refHookRequired struct{}
-
-// RequireRefHook updates the context to indicate a ref hook is required for
-// the current operation
-func RequireRefHook(ctx context.Context) context.Context {
-	return context.WithValue(ctx, refHookRequired{}, true)
-}
-
-// IsRefHookRequired returns true if the context has been marked to indicate a
-// ref hook may be required
-func IsRefHookRequired(ctx context.Context) bool {
-	return ctx.Value(refHookRequired{}) != nil
-}
-
 // ReceivePackRequest abstracts away the different requests that end up
 // spawning git-receive-pack.
 type ReceivePackRequest interface {
diff --git a/internal/git/objectpool/clone_test.go b/internal/git/objectpool/clone_test.go
index cb10fd01d..90f19c15c 100644
--- a/internal/git/objectpool/clone_test.go
+++ b/internal/git/objectpool/clone_test.go
@@ -16,7 +16,7 @@ func TestClone(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.clone(ctx, testRepo)
@@ -34,7 +34,7 @@ func TestCloneExistingPool(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.clone(ctx, testRepo)
diff --git a/internal/git/objectpool/fetch.go b/internal/git/objectpool/fetch.go
index 2bcd3a599..4ac559962 100644
--- a/internal/git/objectpool/fetch.go
+++ b/internal/git/objectpool/fetch.go
@@ -17,6 +17,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
 	"gitlab.com/gitlab-org/gitaly/internal/git/updateref"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
@@ -37,7 +38,11 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 		return err
 	}
 
-	getRemotes, err := git.SafeCmd(ctx, o, nil, git.SubCmd{Name: "remote"})
+	opts := []git.CmdOpt{
+		git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(o), o.cfg),
+	}
+
+	getRemotes, err := git.SafeCmd(ctx, o, nil, git.SubCmd{Name: "remote"}, opts...)
 	if err != nil {
 		return err
 	}
@@ -59,7 +64,7 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 		setOriginCmd, err = git.SafeCmd(ctx, o, nil, git.SubCmd{
 			Name: "remote",
 			Args: []string{"set-url", sourceRemote, originPath},
-		})
+		}, opts...)
 		if err != nil {
 			return err
 		}
@@ -67,7 +72,7 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 		setOriginCmd, err = git.SafeCmd(ctx, o, nil, git.SubCmd{
 			Name: "remote",
 			Args: []string{"add", sourceRemote, originPath},
-		})
+		}, opts...)
 		if err != nil {
 			return err
 		}
@@ -82,11 +87,14 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 	}
 
 	refSpec := fmt.Sprintf("+refs/*:%s/*", sourceRefNamespace)
-	fetchCmd, err := git.SafeCmd(ctx, o, nil, git.SubCmd{
-		Name:  "fetch",
-		Flags: []git.Option{git.Flag{Name: "--quiet"}},
-		Args:  []string{sourceRemote, refSpec},
-	})
+	fetchCmd, err := git.SafeCmd(ctx, o, nil,
+		git.SubCmd{
+			Name:  "fetch",
+			Flags: []git.Option{git.Flag{Name: "--quiet"}},
+			Args:  []string{sourceRemote, refSpec},
+		},
+		opts...,
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/git/objectpool/fetch_test.go b/internal/git/objectpool/fetch_test.go
index 4998d2b3a..d3338e785 100644
--- a/internal/git/objectpool/fetch_test.go
+++ b/internal/git/objectpool/fetch_test.go
@@ -18,7 +18,7 @@ func TestFetchFromOriginDangling(t *testing.T) {
 	source, _, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	ctx, cancel := testhelper.Context()
@@ -90,7 +90,7 @@ func TestFetchFromOriginDeltaIslands(t *testing.T) {
 	source, sourcePath, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	ctx, cancel := testhelper.Context()
@@ -116,7 +116,7 @@ func TestFetchFromOriginBitmapHashCache(t *testing.T) {
 	source, _, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	ctx, cancel := testhelper.Context()
@@ -145,7 +145,7 @@ func TestFetchFromOriginRefUpdates(t *testing.T) {
 	source, sourcePath, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	poolPath := pool.FullPath()
 
diff --git a/internal/git/objectpool/link.go b/internal/git/objectpool/link.go
index 8f845d813..ea48e2787 100644
--- a/internal/git/objectpool/link.go
+++ b/internal/git/objectpool/link.go
@@ -168,8 +168,8 @@ func (o *ObjectPool) Unlink(ctx context.Context, repo *gitalypb.Repository) erro
 	// We need to use removeRemote, and can't leverage `git config --remove-section`
 	// as the latter doesn't clean up refs
 	remoteName := repo.GetGlRepository()
-	if err := remote.Remove(ctx, o, remoteName); err != nil {
-		if present, err2 := remote.Exists(ctx, o, remoteName); err2 != nil || present {
+	if err := remote.Remove(ctx, o.cfg, o, remoteName); err != nil {
+		if present, err2 := remote.Exists(ctx, o.cfg, o, remoteName); err2 != nil || present {
 			return err
 		}
 	}
diff --git a/internal/git/objectpool/pool.go b/internal/git/objectpool/pool.go
index 9cef00394..2f9fc4b09 100644
--- a/internal/git/objectpool/pool.go
+++ b/internal/git/objectpool/pool.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -32,6 +33,7 @@ const ErrInvalidPoolDir errString = "invalid object pool directory"
 // live in a pool in a distinct repository which is used as an alternate object
 // store for other repositories.
 type ObjectPool struct {
+	cfg         config.Cfg
 	locator     storage.Locator
 	storageName string
 	storagePath string
@@ -42,7 +44,7 @@ type ObjectPool struct {
 // NewObjectPool will initialize the object with the required data on the storage
 // shard. Relative path is validated to match the expected naming and directory
 // structure. If the shard cannot be found, this function returns an error.
-func NewObjectPool(locator storage.Locator, storageName, relativePath string) (pool *ObjectPool, err error) {
+func NewObjectPool(cfg config.Cfg, locator storage.Locator, storageName, relativePath string) (pool *ObjectPool, err error) {
 	storagePath, err := helper.GetStorageByName(storageName)
 	if err != nil {
 		return nil, err
@@ -53,7 +55,7 @@ func NewObjectPool(locator storage.Locator, storageName, relativePath string) (p
 		return nil, ErrInvalidPoolDir
 	}
 
-	return &ObjectPool{locator: locator, storageName: storageName, storagePath: storagePath, relativePath: relativePath}, nil
+	return &ObjectPool{cfg: cfg, locator: locator, storageName: storageName, storagePath: storagePath, relativePath: relativePath}, nil
 }
 
 // GetGitAlternateObjectDirectories for object pools are empty, given pools are
@@ -140,7 +142,7 @@ func (o *ObjectPool) Init(ctx context.Context) (err error) {
 }
 
 // FromRepo returns an instance of ObjectPool that the repository points to
-func FromRepo(locator storage.Locator, repo *gitalypb.Repository) (*ObjectPool, error) {
+func FromRepo(cfg config.Cfg, locator storage.Locator, repo *gitalypb.Repository) (*ObjectPool, error) {
 	dir, err := getAlternateObjectDir(locator, repo)
 	if err != nil {
 		return nil, err
@@ -160,7 +162,7 @@ func FromRepo(locator storage.Locator, repo *gitalypb.Repository) (*ObjectPool,
 		return nil, err
 	}
 
-	return NewObjectPool(locator, repo.GetStorageName(), filepath.Dir(altPathRelativeToStorage))
+	return NewObjectPool(cfg, locator, repo.GetStorageName(), filepath.Dir(altPathRelativeToStorage))
 }
 
 var (
diff --git a/internal/git/objectpool/pool_test.go b/internal/git/objectpool/pool_test.go
index 2a2dd2c54..3149cfa03 100644
--- a/internal/git/objectpool/pool_test.go
+++ b/internal/git/objectpool/pool_test.go
@@ -14,10 +14,10 @@ import (
 )
 
 func TestNewObjectPool(t *testing.T) {
-	_, err := NewObjectPool(nil, "default", testhelper.NewTestObjectPoolName(t))
+	_, err := NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
-	_, err = NewObjectPool(nil, "mepmep", testhelper.NewTestObjectPoolName(t))
+	_, err = NewObjectPool(config.Config, config.NewLocator(config.Config), "mepmep", testhelper.NewTestObjectPoolName(t))
 	require.Error(t, err, "creating pool in storage that does not exist should fail")
 }
 
@@ -27,9 +27,8 @@ func TestNewFromRepoSuccess(t *testing.T) {
 	defer cleanup()
 
 	relativePoolPath := testhelper.NewTestObjectPoolName(t)
-	locator := config.NewLocator(config.Config)
 
-	pool, err := NewObjectPool(locator, testRepo.GetStorageName(), relativePoolPath)
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), relativePoolPath)
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -37,7 +36,7 @@ func TestNewFromRepoSuccess(t *testing.T) {
 	require.NoError(t, pool.Create(ctx, testRepo))
 	require.NoError(t, pool.Link(ctx, testRepo))
 
-	poolFromRepo, err := FromRepo(locator, testRepo)
+	poolFromRepo, err := FromRepo(config.Config, config.NewLocator(config.Config), testRepo)
 	require.NoError(t, err)
 	require.Equal(t, relativePoolPath, poolFromRepo.relativePath)
 	require.Equal(t, pool.storageName, poolFromRepo.storageName)
@@ -47,10 +46,8 @@ func TestNewFromRepoNoObjectPool(t *testing.T) {
 	testRepo, testRepoPath, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	locator := config.NewLocator(config.Config)
-
 	// no alternates file
-	poolFromRepo, err := FromRepo(locator, testRepo)
+	poolFromRepo, err := FromRepo(config.Config, config.NewLocator(config.Config), testRepo)
 	require.Equal(t, ErrAlternateObjectDirNotExist, err)
 	require.Nil(t, poolFromRepo)
 
@@ -83,7 +80,7 @@ func TestNewFromRepoNoObjectPool(t *testing.T) {
 		t.Run(tc.desc, func(t *testing.T) {
 			alternateFilePath := filepath.Join(testRepoPath, "objects", "info", "alternates")
 			require.NoError(t, ioutil.WriteFile(alternateFilePath, tc.fileContent, 0644))
-			poolFromRepo, err := FromRepo(locator, testRepo)
+			poolFromRepo, err := FromRepo(config.Config, config.NewLocator(config.Config), testRepo)
 			require.Equal(t, tc.expectedErr, err)
 			require.Nil(t, poolFromRepo)
 
@@ -101,7 +98,7 @@ func TestCreate(t *testing.T) {
 
 	masterSha := testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "show-ref", "master")
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.Create(ctx, testRepo)
@@ -134,7 +131,7 @@ func TestCreateSubDirsExist(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	defer pool.Remove(ctx)
 	require.NoError(t, err)
 
@@ -155,7 +152,7 @@ func TestRemove(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.Create(ctx, testRepo)
diff --git a/internal/git/objectpool/proto.go b/internal/git/objectpool/proto.go
index 1e69f5a50..caa3db344 100644
--- a/internal/git/objectpool/proto.go
+++ b/internal/git/objectpool/proto.go
@@ -1,13 +1,14 @@
 package objectpool
 
 import (
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 // FromProto returns an object pool object from a git repository object
-func FromProto(locator storage.Locator, o *gitalypb.ObjectPool) (*ObjectPool, error) {
-	return NewObjectPool(locator, o.GetRepository().GetStorageName(), o.GetRepository().GetRelativePath())
+func FromProto(cfg config.Cfg, locator storage.Locator, o *gitalypb.ObjectPool) (*ObjectPool, error) {
+	return NewObjectPool(cfg, locator, o.GetRepository().GetStorageName(), o.GetRepository().GetRelativePath())
 }
 
 // ToProto returns a new struct that is the protobuf definition of the ObjectPool
diff --git a/internal/git/objectpool/testhelper_test.go b/internal/git/objectpool/testhelper_test.go
index 21eef190a..49b5d19ea 100644
--- a/internal/git/objectpool/testhelper_test.go
+++ b/internal/git/objectpool/testhelper_test.go
@@ -16,7 +16,7 @@ func TestMain(m *testing.M) {
 }
 
 func NewTestObjectPool(ctx context.Context, t *testing.T, storageName string) (*ObjectPool, func()) {
-	pool, err := NewObjectPool(config.NewLocator(config.Config), storageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), storageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	return pool, func() {
 		require.NoError(t, pool.Remove(ctx))
diff --git a/internal/git/remote.go b/internal/git/remote.go
index 79bc86123..399342024 100644
--- a/internal/git/remote.go
+++ b/internal/git/remote.go
@@ -9,6 +9,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/client"
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -192,6 +193,7 @@ func (repo RepositoryRemote) Add(ctx context.Context, name, url string, opts Rem
 			Args:  []string{name, url},
 		},
 		WithStderr(&stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
@@ -229,6 +231,7 @@ func (repo RepositoryRemote) Remove(ctx context.Context, name string) error {
 			Args:  []string{name},
 		},
 		WithStderr(&stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
@@ -284,6 +287,7 @@ func (repo RepositoryRemote) SetURL(ctx context.Context, name, url string, opts
 			Args:  []string{name, url},
 		},
 		WithStderr(&stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
diff --git a/internal/git/remote/remote.go b/internal/git/remote/remote.go
index 41e83b187..a21bb5af7 100644
--- a/internal/git/remote/remote.go
+++ b/internal/git/remote/remote.go
@@ -6,15 +6,17 @@ import (
 
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 )
 
 //Remove removes the remote from repository
-func Remove(ctx context.Context, repo repository.GitRepo, name string) error {
+func Remove(ctx context.Context, cfg config.Cfg, repo repository.GitRepo, name string) error {
 	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
 		Name:  "remote",
 		Flags: []git.Option{git.SubSubCmd{Name: "remove"}},
 		Args:  []string{name},
-	})
+	}, git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo), cfg))
 	if err != nil {
 		return err
 	}
@@ -24,8 +26,11 @@ func Remove(ctx context.Context, repo repository.GitRepo, name string) error {
 
 // Exists will always return a boolean value, but should only be depended on
 // when the error value is nil
-func Exists(ctx context.Context, repo repository.GitRepo, name string) (bool, error) {
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "remote"})
+func Exists(ctx context.Context, cfg config.Cfg, repo repository.GitRepo, name string) (bool, error) {
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{Name: "remote"},
+		git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo), cfg),
+	)
 	if err != nil {
 		return false, err
 	}
diff --git a/internal/git/remote/remote_test.go b/internal/git/remote/remote_test.go
index 99a963741..b84588850 100644
--- a/internal/git/remote/remote_test.go
+++ b/internal/git/remote/remote_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 )
 
@@ -22,7 +23,7 @@ func TestRemoveRemote(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	require.NoError(t, Remove(ctx, testRepo, "origin"))
+	require.NoError(t, Remove(ctx, config.Config, testRepo, "origin"))
 
 	repoPath := filepath.Join(testhelper.GitlabTestStoragePath(), testRepo.RelativePath)
 
@@ -45,7 +46,7 @@ func TestRemoveRemoteDontRemoveLocalBranches(t *testing.T) {
 
 	masterBeforeRemove := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show-ref", "refs/heads/master")
 
-	require.NoError(t, Remove(ctx, testRepo, "origin"))
+	require.NoError(t, Remove(ctx, config.Config, testRepo, "origin"))
 
 	out := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "remote")
 	require.Len(t, out, 0)
@@ -61,11 +62,11 @@ func TestRemoteExists(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	found, err := Exists(ctx, testRepo, "origin")
+	found, err := Exists(ctx, config.Config, testRepo, "origin")
 	require.NoError(t, err)
 	require.True(t, found)
 
-	found, err = Exists(ctx, testRepo, "can-not-be-found")
+	found, err = Exists(ctx, config.Config, testRepo, "can-not-be-found")
 	require.NoError(t, err)
 	require.False(t, found)
 }
diff --git a/internal/git/repository.go b/internal/git/repository.go
index a8a23099b..81a433192 100644
--- a/internal/git/repository.go
+++ b/internal/git/repository.go
@@ -12,6 +12,8 @@ import (
 
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/text"
 )
 
@@ -388,10 +390,14 @@ func (repo *localRepository) GetBranches(ctx context.Context) ([]Reference, erro
 }
 
 func (repo *localRepository) UpdateRef(ctx context.Context, reference, newrev, oldrev string) error {
-	cmd, err := repo.command(ctx, nil, SubCmd{
-		Name:  "update-ref",
-		Flags: []Option{Flag{Name: "-z"}, Flag{Name: "--stdin"}},
-	}, WithStdin(strings.NewReader(fmt.Sprintf("update %s\x00%s\x00%s\x00", reference, newrev, oldrev))))
+	cmd, err := repo.command(ctx, nil,
+		SubCmd{
+			Name:  "update-ref",
+			Flags: []Option{Flag{Name: "-z"}, Flag{Name: "--stdin"}},
+		},
+		WithStdin(strings.NewReader(fmt.Sprintf("update %s\x00%s\x00%s\x00", reference, newrev, oldrev))),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
+	)
 	if err != nil {
 		return err
 	}
@@ -415,6 +421,7 @@ func (repo *localRepository) FetchRemote(ctx context.Context, remoteName string,
 			Args:  []string{remoteName},
 		},
 		WithStderr(opts.Stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
diff --git a/internal/git/safecmd.go b/internal/git/safecmd.go
index d88c29513..d7f011a51 100644
--- a/internal/git/safecmd.go
+++ b/internal/git/safecmd.go
@@ -274,7 +274,7 @@ func handleOpts(ctx context.Context, sc Cmd, cc *cmdCfg, opts []CmdOpt) error {
 		}
 	}
 
-	if IsRefHookRequired(ctx) && !cc.refHookConfigured && mayUpdateRef(sc.Subcommand()) {
+	if !cc.refHookConfigured && mayUpdateRef(sc.Subcommand()) {
 		return fmt.Errorf("subcommand %q: %w", sc.Subcommand(), ErrRefHookRequired)
 	}
 	if cc.refHookConfigured && !mayUpdateRef(sc.Subcommand()) {
diff --git a/internal/git/safecmd_test.go b/internal/git/safecmd_test.go
index 9c60ab1cf..735b34d61 100644
--- a/internal/git/safecmd_test.go
+++ b/internal/git/safecmd_test.go
@@ -112,6 +112,7 @@ func TestSafeCmdInvalidArg(t *testing.T) {
 			&gitalypb.Repository{},
 			tt.globals,
 			tt.subCmd,
+			git.WithRefTxHook(context.Background(), &gitalypb.Repository{}, config.Config),
 		)
 		require.EqualError(t, err, tt.errMsg)
 		require.True(t, git.IsInvalidArgErr(err))
@@ -198,21 +199,22 @@ func TestSafeCmdValid(t *testing.T) {
 			expectArgs: []string{"--contributing", "--author", "a-gopher", "accept", "--is-important", "--why", "looking-for-first-contribution", "mr", endOfOptions},
 		},
 	} {
-		cmd, err := git.SafeCmd(ctx, testRepo, tt.globals, tt.subCmd)
+		opts := []git.CmdOpt{git.WithRefTxHook(ctx, &gitalypb.Repository{}, config.Config)}
+		cmd, err := git.SafeCmd(ctx, testRepo, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		// ignore first 3 indeterministic args (executable path and repo args)
 		require.Equal(t, tt.expectArgs, cmd.Args()[3:])
 
-		cmd, err = git.SafeCmdWithEnv(ctx, nil, testRepo, tt.globals, tt.subCmd)
+		cmd, err = git.SafeCmdWithEnv(ctx, nil, testRepo, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		// ignore first 3 indeterministic args (executable path and repo args)
 		require.Equal(t, tt.expectArgs, cmd.Args()[3:])
 
-		cmd, err = git.SafeStdinCmd(ctx, testRepo, tt.globals, tt.subCmd)
+		cmd, err = git.SafeStdinCmd(ctx, testRepo, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		require.Equal(t, tt.expectArgs, cmd.Args()[3:])
 
-		cmd, err = git.SafeBareCmd(ctx, git.CmdStream{}, nil, tt.globals, tt.subCmd)
+		cmd, err = git.SafeBareCmd(ctx, git.CmdStream{}, nil, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		// ignore first indeterministic arg (executable path)
 		require.Equal(t, tt.expectArgs, cmd.Args()[1:])
@@ -243,7 +245,8 @@ func TestSafeCmdWithEnv(t *testing.T) {
 
 	env := []string{"TEST_VAR1=1", "TEST_VAR2=2"}
 
-	cmd, err := git.SafeCmdWithEnv(ctx, env, testRepo, globals, subCmd)
+	opts := []git.CmdOpt{git.WithRefTxHook(ctx, &gitalypb.Repository{}, config.Config)}
+	cmd, err := git.SafeCmdWithEnv(ctx, env, testRepo, globals, subCmd, opts...)
 	require.NoError(t, err)
 	// ignore first 3 indeterministic args (executable path and repo args)
 	require.Equal(t, expectArgs, cmd.Args()[3:])
diff --git a/internal/git/subcommand.go b/internal/git/subcommand.go
index 902bc7760..0a837723b 100644
--- a/internal/git/subcommand.go
+++ b/internal/git/subcommand.go
@@ -13,16 +13,41 @@ const (
 	scDiff           = "diff"
 	scPackRefs       = "pack-refs"
 	scMergeBase      = "merge-base"
+	scHashObject     = "hash-object"
+	scShowRef        = "show-ref"
+	scUploadPack     = "upload-pack"
+	scUploadArchive  = "upload-archive"
+	scBlame          = "blame"
+	scLsTree         = "ls-tree"
+	scRevList        = "rev-list"
+	scLsRemote       = "ls-remote"
+	scFsck           = "fsck"
+	scGrep           = "grep"
+	scBundle         = "bundle"
+	scArchive        = "archive"
+	scFormatPatch    = "format-patch"
 )
 
 var knownReadOnlyCmds = map[string]struct{}{
-	scCatFile:      struct{}{},
-	scLog:          struct{}{},
-	scForEachRef:   struct{}{},
-	scRevParse:     struct{}{},
-	scCountObjects: struct{}{},
-	scDiff:         struct{}{},
-	scMergeBase:    struct{}{},
+	scCatFile:       struct{}{},
+	scLog:           struct{}{},
+	scForEachRef:    struct{}{},
+	scRevParse:      struct{}{},
+	scCountObjects:  struct{}{},
+	scDiff:          struct{}{},
+	scMergeBase:     struct{}{},
+	scShowRef:       struct{}{},
+	scUploadPack:    struct{}{},
+	scUploadArchive: struct{}{},
+	scBlame:         struct{}{},
+	scLsTree:        struct{}{},
+	scRevList:       struct{}{},
+	scLsRemote:      struct{}{},
+	scFsck:          struct{}{},
+	scGrep:          struct{}{},
+	scBundle:        struct{}{},
+	scArchive:       struct{}{},
+	scFormatPatch:   struct{}{},
 }
 
 // knownNoRefUpdates indicates all repo mutating commands where it is known
@@ -32,6 +57,7 @@ var knownNoRefUpdates = map[string]struct{}{
 	scMultiPackIndex: struct{}{},
 	scRepack:         struct{}{},
 	scPackRefs:       struct{}{},
+	scHashObject:     struct{}{},
 }
 
 // mayUpdateRef indicates if a subcommand is known to update references.
diff --git a/internal/git/updateref/updateref.go b/internal/git/updateref/updateref.go
index 10d9901ca..20c3c7498 100644
--- a/internal/git/updateref/updateref.go
+++ b/internal/git/updateref/updateref.go
@@ -7,6 +7,8 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 )
 
 // Updater wraps a `git update-ref --stdin` process, presenting an interface
@@ -24,10 +26,13 @@ type Updater struct {
 // It is important that ctx gets canceled somewhere. If it doesn't, the process
 // spawned by New() may never terminate.
 func New(ctx context.Context, repo repository.GitRepo) (*Updater, error) {
-	cmd, err := git.SafeStdinCmd(ctx, repo, nil, git.SubCmd{
-		Name:  "update-ref",
-		Flags: []git.Option{git.Flag{Name: "-z"}, git.Flag{Name: "--stdin"}},
-	})
+	cmd, err := git.SafeStdinCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name:  "update-ref",
+			Flags: []git.Option{git.Flag{Name: "-z"}, git.Flag{Name: "--stdin"}},
+		},
+		git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo), config.Config),
+	)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/gitaly/service/objectpool/alternates_test.go b/internal/gitaly/service/objectpool/alternates_test.go
index f9ff064e2..7db5629a9 100644
--- a/internal/gitaly/service/objectpool/alternates_test.go
+++ b/internal/gitaly/service/objectpool/alternates_test.go
@@ -9,13 +9,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 func TestDisconnectGitAlternates(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -28,7 +28,7 @@ func TestDisconnectGitAlternates(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -65,7 +65,7 @@ func TestDisconnectGitAlternates(t *testing.T) {
 }
 
 func TestDisconnectGitAlternatesNoAlternates(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -89,7 +89,7 @@ func TestDisconnectGitAlternatesNoAlternates(t *testing.T) {
 }
 
 func TestDisconnectGitAlternatesUnexpectedAlternates(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -135,7 +135,7 @@ func TestRemoveAlternatesIfOk(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	altPath, err := locator.InfoAlternatesPath(testRepo)
 	require.NoError(t, err, "find info/alternates")
 	altContent := "/var/empty\n"
diff --git a/internal/gitaly/service/objectpool/create.go b/internal/gitaly/service/objectpool/create.go
index 407e56287..8815302fb 100644
--- a/internal/gitaly/service/objectpool/create.go
+++ b/internal/gitaly/service/objectpool/create.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
@@ -67,7 +68,7 @@ func (s *server) poolForRequest(req poolRequest) (*objectpool.ObjectPool, error)
 		return nil, errMissingPool
 	}
 
-	pool, err := objectpool.NewObjectPool(s.locator, poolRepo.GetStorageName(), poolRepo.GetRelativePath())
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), poolRepo.GetStorageName(), poolRepo.GetRelativePath())
 	if err != nil {
 		if err == objectpool.ErrInvalidPoolDir {
 			return nil, errInvalidPoolDir
diff --git a/internal/gitaly/service/objectpool/create_test.go b/internal/gitaly/service/objectpool/create_test.go
index 69bfeb0f1..04cb848cb 100644
--- a/internal/gitaly/service/objectpool/create_test.go
+++ b/internal/gitaly/service/objectpool/create_test.go
@@ -29,7 +29,7 @@ func TestCreate(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	poolReq := &gitalypb.CreateObjectPoolRequest{
@@ -77,7 +77,7 @@ func TestUnsuccessfulCreate(t *testing.T) {
 	defer cleanupFn()
 
 	validPoolPath := testhelper.NewTestObjectPoolName(t)
-	pool, err := objectpool.NewObjectPool(locator, "default", validPoolPath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", validPoolPath)
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -177,7 +177,7 @@ func TestDelete(t *testing.T) {
 	defer cleanupFn()
 
 	validPoolPath := testhelper.NewTestObjectPoolName(t)
-	pool, err := objectpool.NewObjectPool(locator, "default", validPoolPath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", validPoolPath)
 	require.NoError(t, err)
 	require.NoError(t, pool.Create(ctx, testRepo))
 
diff --git a/internal/gitaly/service/objectpool/fetch_into_object_pool.go b/internal/gitaly/service/objectpool/fetch_into_object_pool.go
index e289dccd8..cf1c44482 100644
--- a/internal/gitaly/service/objectpool/fetch_into_object_pool.go
+++ b/internal/gitaly/service/objectpool/fetch_into_object_pool.go
@@ -7,6 +7,7 @@ import (
 
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
 	"gitlab.com/gitlab-org/gitaly/internal/git/stats"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -16,7 +17,7 @@ func (s *server) FetchIntoObjectPool(ctx context.Context, req *gitalypb.FetchInt
 		return nil, helper.ErrInvalidArgument(err)
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetObjectPool())
+	objectPool, err := objectpool.FromProto(config.Config, config.NewLocator(config.Config), req.GetObjectPool())
 	if err != nil {
 		return nil, helper.ErrInvalidArgument(fmt.Errorf("object pool invalid: %v", err))
 	}
diff --git a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
index b3503381e..71bd8533c 100644
--- a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
+++ b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/labkit/log"
@@ -20,7 +20,7 @@ import (
 )
 
 func TestFetchIntoObjectPool_Success(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -35,7 +35,7 @@ func TestFetchIntoObjectPool_Success(t *testing.T) {
 
 	repoCommit := testhelper.CreateCommit(t, testRepoPath, t.Name(), &testhelper.CreateCommitOpts{Message: t.Name()})
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -79,7 +79,7 @@ func TestFetchIntoObjectPool_CollectLogStatistics(t *testing.T) {
 	defer cancel()
 	ctx = ctxlogrus.ToContext(ctx, log.WithField("test", "logging"))
 
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -89,7 +89,7 @@ func TestFetchIntoObjectPool_CollectLogStatistics(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -118,7 +118,7 @@ func TestFetchIntoObjectPool_CollectLogStatistics(t *testing.T) {
 }
 
 func TestFetchIntoObjectPool_Failure(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server := NewServer(locator)
 
 	ctx, cancel := testhelper.Context()
@@ -127,7 +127,7 @@ func TestFetchIntoObjectPool_Failure(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
diff --git a/internal/gitaly/service/objectpool/get.go b/internal/gitaly/service/objectpool/get.go
index c409ee869..70a775610 100644
--- a/internal/gitaly/service/objectpool/get.go
+++ b/internal/gitaly/service/objectpool/get.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -15,7 +16,7 @@ func (s *server) GetObjectPool(ctx context.Context, in *gitalypb.GetObjectPoolRe
 		return nil, helper.ErrInternal(errors.New("repository is empty"))
 	}
 
-	objectPool, err := objectpool.FromRepo(s.locator, in.GetRepository())
+	objectPool, err := objectpool.FromRepo(config.Config, config.NewLocator(config.Config), in.GetRepository())
 
 	if err != nil {
 		ctxlogrus.Extract(ctx).
diff --git a/internal/gitaly/service/objectpool/get_test.go b/internal/gitaly/service/objectpool/get_test.go
index 7294daa53..5cc12bda0 100644
--- a/internal/gitaly/service/objectpool/get_test.go
+++ b/internal/gitaly/service/objectpool/get_test.go
@@ -8,13 +8,13 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 func TestGetObjectPoolSuccess(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -26,7 +26,7 @@ func TestGetObjectPoolSuccess(t *testing.T) {
 
 	relativePoolPath := testhelper.NewTestObjectPoolName(t)
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), relativePoolPath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), relativePoolPath)
 	require.NoError(t, err)
 
 	poolCtx, cancel := testhelper.Context()
@@ -47,7 +47,7 @@ func TestGetObjectPoolSuccess(t *testing.T) {
 }
 
 func TestGetObjectPoolNoFile(t *testing.T) {
-	server, serverSocketPath := runObjectPoolServer(t, gconfig.NewLocator(gconfig.Config))
+	server, serverSocketPath := runObjectPoolServer(t, config.NewLocator(config.Config))
 	defer server.Stop()
 
 	client, conn := newObjectPoolClient(t, serverSocketPath)
@@ -68,7 +68,7 @@ func TestGetObjectPoolNoFile(t *testing.T) {
 }
 
 func TestGetObjectPoolBadFile(t *testing.T) {
-	server, serverSocketPath := runObjectPoolServer(t, gconfig.NewLocator(gconfig.Config))
+	server, serverSocketPath := runObjectPoolServer(t, config.NewLocator(config.Config))
 	defer server.Stop()
 
 	client, conn := newObjectPoolClient(t, serverSocketPath)
diff --git a/internal/gitaly/service/objectpool/link_test.go b/internal/gitaly/service/objectpool/link_test.go
index 1a71288bb..b4aa0fea5 100644
--- a/internal/gitaly/service/objectpool/link_test.go
+++ b/internal/gitaly/service/objectpool/link_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git/log"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -17,7 +17,7 @@ import (
 )
 
 func TestLink(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -30,7 +30,7 @@ func TestLink(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	require.NoError(t, pool.Remove(ctx), "make sure pool does not exist at start of test")
@@ -91,7 +91,7 @@ func TestLink(t *testing.T) {
 }
 
 func TestLinkIdempotent(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -104,7 +104,7 @@ func TestLinkIdempotent(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 	require.NoError(t, pool.Create(ctx, testRepo))
@@ -122,7 +122,7 @@ func TestLinkIdempotent(t *testing.T) {
 }
 
 func TestLinkNoClobber(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -135,7 +135,7 @@ func TestLinkNoClobber(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -162,7 +162,7 @@ func TestLinkNoClobber(t *testing.T) {
 }
 
 func TestLinkNoPool(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -175,7 +175,7 @@ func TestLinkNoPool(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	// intentionally do not call pool.Create
 	defer pool.Remove(ctx)
@@ -195,7 +195,7 @@ func TestLinkNoPool(t *testing.T) {
 }
 
 func TestUnlink(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -211,7 +211,7 @@ func TestUnlink(t *testing.T) {
 	deletedRepo, deletedRepoPath, removeDeletedRepo := testhelper.NewTestRepo(t)
 	defer removeDeletedRepo()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -222,7 +222,7 @@ func TestUnlink(t *testing.T) {
 	removeDeletedRepo()
 	testhelper.AssertPathNotExists(t, deletedRepoPath)
 
-	pool2, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool2, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	require.NoError(t, pool2.Create(ctx, testRepo), "create pool 2")
 	defer pool2.Remove(ctx)
@@ -308,7 +308,7 @@ func TestUnlink(t *testing.T) {
 }
 
 func TestUnlinkIdempotent(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -321,7 +321,7 @@ func TestUnlinkIdempotent(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 	require.NoError(t, pool.Create(ctx, testRepo))
diff --git a/internal/gitaly/service/objectpool/reduplicate_test.go b/internal/gitaly/service/objectpool/reduplicate_test.go
index c5b197126..597bdd4e7 100644
--- a/internal/gitaly/service/objectpool/reduplicate_test.go
+++ b/internal/gitaly/service/objectpool/reduplicate_test.go
@@ -7,13 +7,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 func TestReduplicate(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -26,7 +26,7 @@ func TestReduplicate(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 	require.NoError(t, pool.Create(ctx, testRepo))
diff --git a/internal/gitaly/service/operations/commit_files.go b/internal/gitaly/service/operations/commit_files.go
index 21cc937d1..a6fd76ee1 100644
--- a/internal/gitaly/service/operations/commit_files.go
+++ b/internal/gitaly/service/operations/commit_files.go
@@ -404,6 +404,7 @@ func (s *server) fetchRemoteObject(ctx context.Context, local, remote *gitalypb.
 			Args:  []string{"ssh://gitaly/internal.git", sha},
 		},
 		git.WithStderr(stderr),
+		git.WithRefTxHook(ctx, local, s.cfg),
 	)
 	if err != nil {
 		return err
diff --git a/internal/gitaly/service/operations/squash.go b/internal/gitaly/service/operations/squash.go
index 86bbc211c..32ec3db84 100644
--- a/internal/gitaly/service/operations/squash.go
+++ b/internal/gitaly/service/operations/squash.go
@@ -319,7 +319,11 @@ func (s *server) addWorktree(ctx context.Context, repo *gitalypb.Repository, wor
 	}
 
 	var stderr bytes.Buffer
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "worktree", Flags: flags, Args: args}, git.WithStderr(&stderr))
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{Name: "worktree", Flags: flags, Args: args},
+		git.WithStderr(&stderr),
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("creation of 'git worktree add': %w", gitError{ErrMsg: stderr.String(), Err: err})
 	}
@@ -332,11 +336,14 @@ func (s *server) addWorktree(ctx context.Context, repo *gitalypb.Repository, wor
 }
 
 func (s *server) removeWorktree(ctx context.Context, repo *gitalypb.Repository, worktreeName string) error {
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-		Name:  "worktree",
-		Flags: []git.Option{git.SubSubCmd{Name: "remove"}, git.Flag{Name: "--force"}},
-		Args:  []string{worktreeName},
-	})
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name:  "worktree",
+			Flags: []git.Option{git.SubSubCmd{Name: "remove"}, git.Flag{Name: "--force"}},
+			Args:  []string{worktreeName},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("creation of 'worktree remove': %w", err)
 	}
diff --git a/internal/gitaly/service/ref/delete_refs.go b/internal/gitaly/service/ref/delete_refs.go
index 4b0baa11e..6444c5743 100644
--- a/internal/gitaly/service/ref/delete_refs.go
+++ b/internal/gitaly/service/ref/delete_refs.go
@@ -3,6 +3,7 @@ package ref
 import (
 	"bufio"
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -21,6 +22,9 @@ func (s *server) DeleteRefs(ctx context.Context, in *gitalypb.DeleteRefsRequest)
 
 	updater, err := updateref.New(ctx, in.GetRepository())
 	if err != nil {
+		if errors.Is(err, git.ErrInvalidArg) {
+			return nil, helper.ErrInvalidArgument(err)
+		}
 		return nil, helper.ErrInternal(err)
 	}
 
diff --git a/internal/gitaly/service/ref/refs.go b/internal/gitaly/service/ref/refs.go
index 97ddd5796..e649869c2 100644
--- a/internal/gitaly/service/ref/refs.go
+++ b/internal/gitaly/service/ref/refs.go
@@ -13,6 +13,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/catfile"
 	gitlog "gitlab.com/gitlab-org/gitaly/internal/git/log"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/chunk"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/lines"
@@ -213,11 +214,11 @@ func _headReference(ctx context.Context, repo *gitalypb.Repository) ([]byte, err
 }
 
 // SetDefaultBranchRef overwrites the default branch ref for the repository
-func SetDefaultBranchRef(ctx context.Context, repo *gitalypb.Repository, ref string) error {
+func SetDefaultBranchRef(ctx context.Context, repo *gitalypb.Repository, ref string, cfg config.Cfg) error {
 	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
 		Name: "symbolic-ref",
 		Args: []string{"HEAD", ref},
-	})
+	}, git.WithRefTxHook(ctx, repo, cfg))
 	if err != nil {
 		return err
 	}
@@ -412,13 +413,16 @@ func parseTagLine(c *catfile.Batch, tagLine string) (*gitalypb.Tag, error) {
 }
 
 func findTag(ctx context.Context, repository *gitalypb.Repository, tagName []byte) (*gitalypb.Tag, error) {
-	tagCmd, err := git.SafeCmd(ctx, repository, nil, git.SubCmd{
-		Name: "tag",
-		Flags: []git.Option{
-			git.Flag{Name: "-l"}, git.ValueFlag{"--format", tagFormat},
+	tagCmd, err := git.SafeCmd(ctx, repository, nil,
+		git.SubCmd{
+			Name: "tag",
+			Flags: []git.Option{
+				git.Flag{Name: "-l"}, git.ValueFlag{"--format", tagFormat},
+			},
+			Args: []string{string(tagName)},
 		},
-		Args: []string{string(tagName)},
-	})
+		git.WithRefTxHook(ctx, repository, config.Config),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("for-each-ref error: %v", err)
 	}
diff --git a/internal/gitaly/service/ref/refs_test.go b/internal/gitaly/service/ref/refs_test.go
index 79194728f..1c2f66431 100644
--- a/internal/gitaly/service/ref/refs_test.go
+++ b/internal/gitaly/service/ref/refs_test.go
@@ -17,6 +17,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git/catfile"
 	"gitlab.com/gitlab-org/gitaly/internal/git/log"
 	"gitlab.com/gitlab-org/gitaly/internal/git/updateref"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -328,7 +329,7 @@ func TestSetDefaultBranchRef(t *testing.T) {
 			testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 			defer cleanupFn()
 
-			err := SetDefaultBranchRef(ctx, testRepo, tc.ref)
+			err := SetDefaultBranchRef(ctx, testRepo, tc.ref, config.Config)
 			require.NoError(t, err)
 
 			newRef, err := DefaultBranchName(ctx, testRepo)
diff --git a/internal/gitaly/service/remote/fetch_internal_remote.go b/internal/gitaly/service/remote/fetch_internal_remote.go
index 5a1391427..ff644e64c 100644
--- a/internal/gitaly/service/remote/fetch_internal_remote.go
+++ b/internal/gitaly/service/remote/fetch_internal_remote.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/service/ref"
 	"gitlab.com/gitlab-org/gitaly/internal/gitalyssh"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
@@ -39,6 +40,7 @@ func (s *server) FetchInternalRemote(ctx context.Context, req *gitalypb.FetchInt
 			Args:  []string{gitalyssh.GitalyInternalURL, mirrorRefSpec},
 		},
 		git.WithStderr(stderr),
+		git.WithRefTxHook(ctx, req.Repository, config.Config),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("create git fetch: %w", err)
@@ -60,7 +62,7 @@ func (s *server) FetchInternalRemote(ctx context.Context, req *gitalypb.FetchInt
 	}
 
 	if !bytes.Equal(defaultBranch, remoteDefaultBranch) {
-		if err := ref.SetDefaultBranchRef(ctx, req.Repository, string(remoteDefaultBranch)); err != nil {
+		if err := ref.SetDefaultBranchRef(ctx, req.Repository, string(remoteDefaultBranch), config.Config); err != nil {
 			return nil, status.Errorf(codes.Internal, "FetchInternalRemote: set default branch: %v", err)
 		}
 	}
diff --git a/internal/gitaly/service/remote/find_remote_root_ref.go b/internal/gitaly/service/remote/find_remote_root_ref.go
index 23dd0c03c..c3ef6a978 100644
--- a/internal/gitaly/service/remote/find_remote_root_ref.go
+++ b/internal/gitaly/service/remote/find_remote_root_ref.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -15,7 +16,9 @@ const headPrefix = "HEAD branch: "
 
 func findRemoteRootRef(ctx context.Context, repo *gitalypb.Repository, remote string) (string, error) {
 	cmd, err := git.SafeCmd(ctx, repo, nil,
-		git.SubCmd{Name: "remote", Flags: []git.Option{git.SubSubCmd{Name: "show"}}, Args: []string{remote}})
+		git.SubCmd{Name: "remote", Flags: []git.Option{git.SubSubCmd{Name: "show"}}, Args: []string{remote}},
+		git.WithRefTxHook(ctx, repo, config.Config),
+	)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/gitaly/service/remote/remotes.go b/internal/gitaly/service/remote/remotes.go
index e8e8897b8..074969d08 100644
--- a/internal/gitaly/service/remote/remotes.go
+++ b/internal/gitaly/service/remote/remotes.go
@@ -11,6 +11,7 @@ import (
 	"github.com/golang/protobuf/proto"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/remote"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/chunk"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -54,7 +55,7 @@ func (s *server) RemoveRemote(ctx context.Context, req *gitalypb.RemoveRemoteReq
 		return nil, status.Errorf(codes.InvalidArgument, "RemoveRemote: %v", err)
 	}
 
-	hasRemote, err := remote.Exists(ctx, req.GetRepository(), req.Name)
+	hasRemote, err := remote.Exists(ctx, config.Config, req.GetRepository(), req.Name)
 	if err != nil {
 		return nil, err
 	}
@@ -62,7 +63,7 @@ func (s *server) RemoveRemote(ctx context.Context, req *gitalypb.RemoveRemoteReq
 		return &gitalypb.RemoveRemoteResponse{Result: false}, nil
 	}
 
-	if err := remote.Remove(ctx, req.GetRepository(), req.Name); err != nil {
+	if err := remote.Remove(ctx, config.Config, req.GetRepository(), req.Name); err != nil {
 		return nil, err
 	}
 
@@ -117,7 +118,9 @@ func (s *server) ListRemotes(req *gitalypb.ListRemotesRequest, stream gitalypb.R
 	repo := req.GetRepository()
 
 	ctx := stream.Context()
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "remote", Flags: []git.Option{git.Flag{Name: "-v"}}})
+	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "remote", Flags: []git.Option{git.Flag{Name: "-v"}}},
+		git.WithRefTxHook(ctx, repo, config.Config),
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/archive.go b/internal/gitaly/service/repository/archive.go
index 61abdee28..bce628c89 100644
--- a/internal/gitaly/service/repository/archive.go
+++ b/internal/gitaly/service/repository/archive.go
@@ -81,7 +81,7 @@ func (s *server) GetArchive(in *gitalypb.GetArchiveRequest, stream gitalypb.Repo
 		return stream.Send(&gitalypb.GetArchiveResponse{Data: p})
 	})
 
-	gitlabConfig, err := json.Marshal(s.cfg)
+	gitlabConfig, err := json.Marshal(s.cfg.Gitlab)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/cleanup.go b/internal/gitaly/service/repository/cleanup.go
index 00b7d49c8..752b89c8e 100644
--- a/internal/gitaly/service/repository/cleanup.go
+++ b/internal/gitaly/service/repository/cleanup.go
@@ -39,11 +39,11 @@ func (s *server) cleanupRepo(ctx context.Context, repo *gitalypb.Repository) err
 	}
 
 	worktreeThreshold := time.Now().Add(-6 * time.Hour)
-	if err := cleanStaleWorktrees(ctx, repo, repoPath, worktreeThreshold); err != nil {
+	if err := s.cleanStaleWorktrees(ctx, repo, repoPath, worktreeThreshold); err != nil {
 		return status.Errorf(codes.Internal, "Cleanup: cleanStaleWorktrees: %v", err)
 	}
 
-	if err := cleanDisconnectedWorktrees(ctx, repo); err != nil {
+	if err := s.cleanDisconnectedWorktrees(ctx, repo); err != nil {
 		return status.Errorf(codes.Internal, "Cleanup: cleanDisconnectedWorktrees: %v", err)
 	}
 
@@ -104,7 +104,7 @@ func cleanPackedRefsLock(repoPath string, threshold time.Time) error {
 	return nil
 }
 
-func cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPath string, threshold time.Time) error {
+func (s *server) cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPath string, threshold time.Time) error {
 	worktreePath := filepath.Join(repoPath, worktreePrefix)
 
 	dirInfo, err := os.Stat(worktreePath)
@@ -126,10 +126,13 @@ func cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPat
 		}
 
 		if info.ModTime().Before(threshold) {
-			cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-				Name:  "worktree",
-				Flags: []git.Option{git.SubSubCmd{"remove"}, git.Flag{Name: "--force"}, git.SubSubCmd{info.Name()}},
-			})
+			cmd, err := git.SafeCmd(ctx, repo, nil,
+				git.SubCmd{
+					Name:  "worktree",
+					Flags: []git.Option{git.SubSubCmd{"remove"}, git.Flag{Name: "--force"}, git.SubSubCmd{info.Name()}},
+				},
+				git.WithRefTxHook(ctx, repo, s.cfg),
+			)
 			if err != nil {
 				return err
 			}
@@ -143,11 +146,14 @@ func cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPat
 	return nil
 }
 
-func cleanDisconnectedWorktrees(ctx context.Context, repo *gitalypb.Repository) error {
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-		Name:  "worktree",
-		Flags: []git.Option{git.SubSubCmd{"prune"}},
-	})
+func (s *server) cleanDisconnectedWorktrees(ctx context.Context, repo *gitalypb.Repository) error {
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name:  "worktree",
+			Flags: []git.Option{git.SubSubCmd{"prune"}},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/clone_from_pool.go b/internal/gitaly/service/repository/clone_from_pool.go
index 6f07fb0f2..b916f7369 100644
--- a/internal/gitaly/service/repository/clone_from_pool.go
+++ b/internal/gitaly/service/repository/clone_from_pool.go
@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -32,7 +33,7 @@ func (s *server) CloneFromPool(ctx context.Context, req *gitalypb.CloneFromPoolR
 		return nil, helper.ErrInternalf("fetch http remote: %v", err)
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return nil, helper.ErrInternalf("get object pool from request: %v", err)
 	}
@@ -54,7 +55,7 @@ func (s *server) validateCloneFromPoolRequestRepositoryState(req *gitalypb.Clone
 		return errors.New("target reopsitory already exists")
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return fmt.Errorf("getting object pool from repository: %v", err)
 	}
diff --git a/internal/gitaly/service/repository/clone_from_pool_internal.go b/internal/gitaly/service/repository/clone_from_pool_internal.go
index 6e3447cdf..7034568b3 100644
--- a/internal/gitaly/service/repository/clone_from_pool_internal.go
+++ b/internal/gitaly/service/repository/clone_from_pool_internal.go
@@ -9,6 +9,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -46,7 +47,7 @@ func (s *server) CloneFromPoolInternal(ctx context.Context, req *gitalypb.CloneF
 		return nil, helper.ErrInternalf("fetch internal remote failed")
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return nil, helper.ErrInternalf("get object pool from request: %v", err)
 	}
@@ -68,7 +69,7 @@ func (s *server) validateCloneFromPoolInternalRequestRepositoryState(req *gitaly
 		return errors.New("target reopsitory already exists")
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return fmt.Errorf("getting object pool from repository: %v", err)
 	}
@@ -119,11 +120,19 @@ func (s *server) cloneFromPool(ctx context.Context, objectPoolRepo *gitalypb.Obj
 		return fmt.Errorf("could not get object pool path: %v", err)
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, nil, nil, git.SubCmd{
-		Name:        "clone",
-		Flags:       []git.Option{git.Flag{Name: "--bare"}, git.Flag{Name: "--shared"}},
-		PostSepArgs: []string{objectPoolPath, repositoryPath},
-	})
+	pbRepo, ok := repo.(*gitalypb.Repository)
+	if !ok {
+		return fmt.Errorf("expected *gitlaypb.Repository but got %T", repo)
+	}
+
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, nil, nil,
+		git.SubCmd{
+			Name:        "clone",
+			Flags:       []git.Option{git.Flag{Name: "--bare"}, git.Flag{Name: "--shared"}},
+			PostSepArgs: []string{objectPoolPath, repositoryPath},
+		},
+		git.WithRefTxHook(ctx, pbRepo, s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("clone with object pool start: %v", err)
 	}
diff --git a/internal/gitaly/service/repository/clone_from_pool_internal_test.go b/internal/gitaly/service/repository/clone_from_pool_internal_test.go
index 719f8b6b2..16f47e6e1 100644
--- a/internal/gitaly/service/repository/clone_from_pool_internal_test.go
+++ b/internal/gitaly/service/repository/clone_from_pool_internal_test.go
@@ -22,7 +22,7 @@ func NewTestObjectPool(t *testing.T) (*objectpool.ObjectPool, *gitalypb.Reposito
 	relativePath := testhelper.NewTestObjectPoolName(t)
 	repo := testhelper.CreateRepo(t, storagePath, relativePath)
 
-	pool, err := objectpool.NewObjectPool(config.NewLocator(config.Config), repo.GetStorageName(), relativePath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), repo.GetStorageName(), relativePath)
 	require.NoError(t, err)
 
 	return pool, repo
diff --git a/internal/gitaly/service/repository/commit_graph.go b/internal/gitaly/service/repository/commit_graph.go
index 845bf3785..5b2a07156 100644
--- a/internal/gitaly/service/repository/commit_graph.go
+++ b/internal/gitaly/service/repository/commit_graph.go
@@ -14,15 +14,15 @@ const (
 )
 
 // WriteCommitGraph write or update commit-graph file in a repository
-func (*server) WriteCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) (*gitalypb.WriteCommitGraphResponse, error) {
-	if err := writeCommitGraph(ctx, in); err != nil {
+func (s *server) WriteCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) (*gitalypb.WriteCommitGraphResponse, error) {
+	if err := s.writeCommitGraph(ctx, in); err != nil {
 		return nil, helper.ErrInternal(fmt.Errorf("WriteCommitGraph: gitCommand: %v", err))
 	}
 
 	return &gitalypb.WriteCommitGraphResponse{}, nil
 }
 
-func writeCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) error {
+func (s *server) writeCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) error {
 	cmd, err := git.SafeCmd(ctx, in.GetRepository(), nil,
 		git.SubCmd{
 			Name: "commit-graph",
@@ -31,6 +31,7 @@ func writeCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest)
 				git.Flag{Name: "--reachable"},
 			},
 		},
+		git.WithRefTxHook(ctx, in.Repository, s.cfg),
 	)
 	if err != nil {
 		return err
diff --git a/internal/gitaly/service/repository/create_from_url.go b/internal/gitaly/service/repository/create_from_url.go
index a40488d10..b430b9565 100644
--- a/internal/gitaly/service/repository/create_from_url.go
+++ b/internal/gitaly/service/repository/create_from_url.go
@@ -17,7 +17,7 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-func cloneFromURLCommand(ctx context.Context, repoURL, repositoryFullPath string, stderr io.Writer) (*command.Command, error) {
+func (s *server) cloneFromURLCommand(ctx context.Context, repo *gitalypb.Repository, repoURL, repositoryFullPath string, stderr io.Writer) (*command.Command, error) {
 	u, err := url.Parse(repoURL)
 	if err != nil {
 		return nil, helper.ErrInternal(err)
@@ -47,11 +47,14 @@ func cloneFromURLCommand(ctx context.Context, repoURL, repositoryFullPath string
 		globalFlags = append(globalFlags, git.ValueFlag{Name: "-c", Value: fmt.Sprintf("http.extraHeader=%s", authHeader)})
 	}
 
-	return git.SafeBareCmd(ctx, git.CmdStream{Err: stderr}, nil, globalFlags, git.SubCmd{
-		Name:        "clone",
-		Flags:       cloneFlags,
-		PostSepArgs: []string{u.String(), repositoryFullPath},
-	})
+	return git.SafeBareCmd(ctx, git.CmdStream{Err: stderr}, nil, globalFlags,
+		git.SubCmd{
+			Name:        "clone",
+			Flags:       cloneFlags,
+			PostSepArgs: []string{u.String(), repositoryFullPath},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 }
 
 func (s *server) CreateRepositoryFromURL(ctx context.Context, req *gitalypb.CreateRepositoryFromURLRequest) (*gitalypb.CreateRepositoryFromURLResponse, error) {
@@ -71,7 +74,7 @@ func (s *server) CreateRepositoryFromURL(ctx context.Context, req *gitalypb.Crea
 	}
 
 	stderr := bytes.Buffer{}
-	cmd, err := cloneFromURLCommand(ctx, req.GetUrl(), repositoryFullPath, &stderr)
+	cmd, err := s.cloneFromURLCommand(ctx, repository, req.GetUrl(), repositoryFullPath, &stderr)
 	if err != nil {
 		return nil, helper.ErrInternal(err)
 	}
@@ -86,7 +89,7 @@ func (s *server) CreateRepositoryFromURL(ctx context.Context, req *gitalypb.Crea
 		return nil, status.Errorf(codes.Internal, "CreateRepositoryFromURL: create hooks failed: %v", err)
 	}
 
-	if err := removeOriginInRepo(ctx, repository); err != nil {
+	if err := s.removeOriginInRepo(ctx, repository); err != nil {
 		return nil, status.Errorf(codes.Internal, "CreateRepositoryFromURL: %v", err)
 	}
 
diff --git a/internal/gitaly/service/repository/create_from_url_test.go b/internal/gitaly/service/repository/create_from_url_test.go
index 0807f47a5..636d35e4f 100644
--- a/internal/gitaly/service/repository/create_from_url_test.go
+++ b/internal/gitaly/service/repository/create_from_url_test.go
@@ -72,7 +72,8 @@ func TestCloneRepositoryFromUrlCommand(t *testing.T) {
 	repositoryFullPath := "full/path/to/repository"
 	url := fmt.Sprintf("https://%s@www.example.com/secretrepo.git", userInfo)
 
-	cmd, err := cloneFromURLCommand(ctx, url, repositoryFullPath, nil)
+	s := &server{cfg: config.Config}
+	cmd, err := s.cloneFromURLCommand(ctx, &gitalypb.Repository{}, url, repositoryFullPath, nil)
 	require.NoError(t, err)
 
 	expectedScrubbedURL := "https://www.example.com/secretrepo.git"
diff --git a/internal/gitaly/service/repository/fetch.go b/internal/gitaly/service/repository/fetch.go
index 4990aac93..9bdc059df 100644
--- a/internal/gitaly/service/repository/fetch.go
+++ b/internal/gitaly/service/repository/fetch.go
@@ -52,6 +52,7 @@ func (s *server) FetchSourceBranch(ctx context.Context, req *gitalypb.FetchSourc
 			Flags: []git.Option{git.Flag{Name: "--prune"}},
 			Args:  []string{remote, refspec},
 		},
+		git.WithRefTxHook(ctx, req.Repository, s.cfg),
 	)
 	if err != nil {
 		return nil, err
diff --git a/internal/gitaly/service/repository/fork.go b/internal/gitaly/service/repository/fork.go
index 7d46acc66..802d5a5c5 100644
--- a/internal/gitaly/service/repository/fork.go
+++ b/internal/gitaly/service/repository/fork.go
@@ -41,14 +41,20 @@ func (s *server) CreateFork(ctx context.Context, req *gitalypb.CreateForkRequest
 		return nil, err
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, env, nil, git.SubCmd{
-		Name:  "clone",
-		Flags: []git.Option{git.Flag{Name: "--bare"}, git.Flag{Name: "--no-local"}},
-		PostSepArgs: []string{
-			fmt.Sprintf("%s:%s", gitalyssh.GitalyInternalURL, sourceRepository.RelativePath),
-			targetRepositoryFullPath,
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, env, nil,
+		git.SubCmd{
+			Name: "clone",
+			Flags: []git.Option{
+				git.Flag{Name: "--bare"},
+				git.Flag{Name: "--no-local"},
+			},
+			PostSepArgs: []string{
+				fmt.Sprintf("%s:%s", gitalyssh.GitalyInternalURL, sourceRepository.RelativePath),
+				targetRepositoryFullPath,
+			},
 		},
-	})
+		git.WithRefTxHook(ctx, req.Repository, s.cfg),
+	)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "CreateFork: clone cmd start: %v", err)
 	}
@@ -56,7 +62,7 @@ func (s *server) CreateFork(ctx context.Context, req *gitalypb.CreateForkRequest
 		return nil, status.Errorf(codes.Internal, "CreateFork: clone cmd wait: %v", err)
 	}
 
-	if err := removeOriginInRepo(ctx, targetRepository); err != nil {
+	if err := s.removeOriginInRepo(ctx, targetRepository); err != nil {
 		return nil, status.Errorf(codes.Internal, "CreateFork: %v", err)
 	}
 
diff --git a/internal/gitaly/service/repository/gc.go b/internal/gitaly/service/repository/gc.go
index 78980e9a5..d95b0952c 100644
--- a/internal/gitaly/service/repository/gc.go
+++ b/internal/gitaly/service/repository/gc.go
@@ -39,7 +39,7 @@ func (s *server) GarbageCollect(ctx context.Context, in *gitalypb.GarbageCollect
 		return nil, err
 	}
 
-	if err := gc(ctx, in); err != nil {
+	if err := s.gc(ctx, in); err != nil {
 		return nil, err
 	}
 
@@ -47,7 +47,7 @@ func (s *server) GarbageCollect(ctx context.Context, in *gitalypb.GarbageCollect
 		return nil, err
 	}
 
-	if err := writeCommitGraph(ctx, &gitalypb.WriteCommitGraphRequest{Repository: repo}); err != nil {
+	if err := s.writeCommitGraph(ctx, &gitalypb.WriteCommitGraphRequest{Repository: repo}); err != nil {
 		return nil, err
 	}
 
@@ -62,7 +62,7 @@ func (s *server) GarbageCollect(ctx context.Context, in *gitalypb.GarbageCollect
 	return &gitalypb.GarbageCollectResponse{}, nil
 }
 
-func gc(ctx context.Context, in *gitalypb.GarbageCollectRequest) error {
+func (s *server) gc(ctx context.Context, in *gitalypb.GarbageCollectRequest) error {
 	args := repackConfig(ctx, in.CreateBitmap)
 
 	var flags []git.Option
@@ -72,6 +72,7 @@ func gc(ctx context.Context, in *gitalypb.GarbageCollectRequest) error {
 
 	cmd, err := git.SafeCmd(ctx, in.GetRepository(), args,
 		git.SubCmd{Name: "gc", Flags: flags},
+		git.WithRefTxHook(ctx, in.GetRepository(), s.cfg),
 	)
 
 	if err != nil {
@@ -148,7 +149,7 @@ func (s *server) cleanupKeepArounds(ctx context.Context, repo *gitalypb.Reposito
 			continue
 		}
 
-		if err := fixRef(ctx, repo, batch, path, refName, info.Name()); err != nil {
+		if err := s.fixRef(ctx, repo, batch, path, refName, info.Name()); err != nil {
 			return err
 		}
 	}
@@ -165,7 +166,7 @@ func checkRef(batch *catfile.Batch, refName string, info os.FileInfo) error {
 	return err
 }
 
-func fixRef(ctx context.Context, repo *gitalypb.Repository, batch *catfile.Batch, refPath string, name string, sha string) error {
+func (s *server) fixRef(ctx context.Context, repo *gitalypb.Repository, batch *catfile.Batch, refPath string, name string, sha string) error {
 	// So the ref is broken, let's get rid of it
 	if err := os.RemoveAll(refPath); err != nil {
 		return err
@@ -177,10 +178,13 @@ func fixRef(ctx context.Context, repo *gitalypb.Repository, batch *catfile.Batch
 	}
 
 	// The name is a valid sha, recreate the ref
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-		Name: "update-ref",
-		Args: []string{name, sha},
-	})
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name: "update-ref",
+			Args: []string{name, sha},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/merge_base.go b/internal/gitaly/service/repository/merge_base.go
index e663085a0..f2019deed 100644
--- a/internal/gitaly/service/repository/merge_base.go
+++ b/internal/gitaly/service/repository/merge_base.go
@@ -21,10 +21,12 @@ func (s *server) FindMergeBase(ctx context.Context, req *gitalypb.FindMergeBaseR
 		return nil, status.Errorf(codes.InvalidArgument, "FindMergeBase: at least 2 revisions are required")
 	}
 
-	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil, git.SubCmd{
-		Name: "merge-base",
-		Args: revisions,
-	})
+	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil,
+		git.SubCmd{
+			Name: "merge-base",
+			Args: revisions,
+		},
+	)
 	if err != nil {
 		if _, ok := status.FromError(err); ok {
 			return nil, err
diff --git a/internal/gitaly/service/repository/remove.go b/internal/gitaly/service/repository/remove.go
index 3a89a1e52..ff7058d91 100644
--- a/internal/gitaly/service/repository/remove.go
+++ b/internal/gitaly/service/repository/remove.go
@@ -5,7 +5,6 @@ import (
 	"os"
 	"path/filepath"
 
-	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/tempdir"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -17,7 +16,7 @@ func (s *server) RemoveRepository(ctx context.Context, in *gitalypb.RemoveReposi
 		return nil, helper.ErrInternal(err)
 	}
 
-	storage, ok := config.Config.Storage(in.GetRepository().GetStorageName())
+	storage, ok := s.cfg.Storage(in.GetRepository().GetStorageName())
 	if !ok {
 		return nil, helper.ErrInvalidArgumentf("storage %v not found", in.GetRepository().GetStorageName())
 	}
diff --git a/internal/gitaly/service/repository/server.go b/internal/gitaly/service/repository/server.go
index f82abaa05..353467b37 100644
--- a/internal/gitaly/service/repository/server.go
+++ b/internal/gitaly/service/repository/server.go
@@ -13,7 +13,7 @@ type server struct {
 	conns                *client.Pool
 	internalGitalySocket string
 	locator              storage.Locator
-	cfg                  config.Gitlab
+	cfg                  config.Cfg
 	binDir               string
 	loggingCfg           config.Logging
 }
@@ -25,7 +25,7 @@ func NewServer(cfg config.Cfg, rs *rubyserver.Server, locator storage.Locator, i
 		locator:              locator,
 		conns:                client.NewPool(),
 		internalGitalySocket: internalGitalySocket,
-		cfg:                  cfg.Gitlab,
+		cfg:                  cfg,
 		binDir:               cfg.BinDir,
 		loggingCfg:           cfg.Logging,
 	}
diff --git a/internal/gitaly/service/repository/util.go b/internal/gitaly/service/repository/util.go
index 16839fa44..c0662ac56 100644
--- a/internal/gitaly/service/repository/util.go
+++ b/internal/gitaly/service/repository/util.go
@@ -8,8 +8,8 @@ import (
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
-func removeOriginInRepo(ctx context.Context, repository *gitalypb.Repository) error {
-	cmd, err := git.SafeCmd(ctx, repository, nil, git.SubCmd{Name: "remote", Args: []string{"remove", "origin"}})
+func (s *server) removeOriginInRepo(ctx context.Context, repository *gitalypb.Repository) error {
+	cmd, err := git.SafeCmd(ctx, repository, nil, git.SubCmd{Name: "remote", Args: []string{"remove", "origin"}}, git.WithRefTxHook(ctx, repository, s.cfg))
 
 	if err != nil {
 		return fmt.Errorf("remote cmd start: %v", err)
diff --git a/internal/gitaly/service/repository/write_ref.go b/internal/gitaly/service/repository/write_ref.go
index bbaf239cb..51a38962a 100644
--- a/internal/gitaly/service/repository/write_ref.go
+++ b/internal/gitaly/service/repository/write_ref.go
@@ -15,22 +15,28 @@ func (s *server) WriteRef(ctx context.Context, req *gitalypb.WriteRefRequest) (*
 	if err := validateWriteRefRequest(req); err != nil {
 		return nil, helper.ErrInvalidArgument(err)
 	}
-	if err := writeRef(ctx, req); err != nil {
+	if err := s.writeRef(ctx, req); err != nil {
 		return nil, helper.ErrInternal(err)
 	}
 
 	return &gitalypb.WriteRefResponse{}, nil
 }
 
-func writeRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
+func (s *server) writeRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
 	if string(req.Ref) == "HEAD" {
-		return updateSymbolicRef(ctx, req)
+		return s.updateSymbolicRef(ctx, req)
 	}
 	return updateRef(ctx, req)
 }
 
-func updateSymbolicRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
-	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil, git.SubCmd{Name: "symbolic-ref", Args: []string{string(req.GetRef()), string(req.GetRevision())}})
+func (s *server) updateSymbolicRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
+	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil,
+		git.SubCmd{
+			Name: "symbolic-ref",
+			Args: []string{string(req.GetRef()), string(req.GetRevision())},
+		},
+		git.WithRefTxHook(ctx, req.GetRepository(), s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("error when creating symbolic-ref command: %v", err)
 	}
diff --git a/internal/gitaly/service/smarthttp/inforefs.go b/internal/gitaly/service/smarthttp/inforefs.go
index dd4b78a24..71034daaa 100644
--- a/internal/gitaly/service/smarthttp/inforefs.go
+++ b/internal/gitaly/service/smarthttp/inforefs.go
@@ -9,6 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/pktline"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/streamio"
 	"google.golang.org/grpc/codes"
@@ -48,8 +49,10 @@ func (s *server) handleInfoRefs(ctx context.Context, service string, req *gitaly
 	}
 
 	var globalOpts []git.Option
+	cmdOpts := []git.CmdOpt{git.WithGitProtocol(ctx, req)}
 	if service == "receive-pack" {
 		globalOpts = append(globalOpts, git.ReceivePackConfig()...)
+		cmdOpts = append(cmdOpts, git.WithRefTxHook(ctx, req.Repository, config.Config))
 	}
 
 	if service == "upload-pack" {
@@ -64,7 +67,7 @@ func (s *server) handleInfoRefs(ctx context.Context, service string, req *gitaly
 		Name:  service,
 		Flags: []git.Option{git.Flag{Name: "--stateless-rpc"}, git.Flag{Name: "--advertise-refs"}},
 		Args:  []string{repoPath},
-	}, git.WithGitProtocol(ctx, req))
+	}, cmdOpts...)
 
 	if err != nil {
 		if _, ok := status.FromError(err); ok {
diff --git a/internal/gitaly/service/smarthttp/inforefs_test.go b/internal/gitaly/service/smarthttp/inforefs_test.go
index 692f7f132..a9ff321bf 100644
--- a/internal/gitaly/service/smarthttp/inforefs_test.go
+++ b/internal/gitaly/service/smarthttp/inforefs_test.go
@@ -193,7 +193,7 @@ func TestObjectPoolRefAdvertisementHiding(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	pool, err := objectpool.NewObjectPool(config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	require.NoError(t, pool.Create(ctx, repo))
diff --git a/internal/gitaly/service/smarthttp/receive_pack.go b/internal/gitaly/service/smarthttp/receive_pack.go
index 31e0128ba..f1187a2b3 100644
--- a/internal/gitaly/service/smarthttp/receive_pack.go
+++ b/internal/gitaly/service/smarthttp/receive_pack.go
@@ -4,6 +4,7 @@ import (
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/streamio"
@@ -47,11 +48,16 @@ func (s *server) PostReceivePack(stream gitalypb.SmartHTTPService_PostReceivePac
 		globalOpts = append(globalOpts, git.ValueFlag{"-c", o})
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout}, nil, globalOpts, git.SubCmd{
-		Name:  "receive-pack",
-		Flags: []git.Option{git.Flag{Name: "--stateless-rpc"}},
-		Args:  []string{repoPath},
-	}, git.WithReceivePackHooks(ctx, req, "http"), git.WithGitProtocol(ctx, req))
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout}, nil, globalOpts,
+		git.SubCmd{
+			Name:  "receive-pack",
+			Flags: []git.Option{git.Flag{Name: "--stateless-rpc"}},
+			Args:  []string{repoPath},
+		},
+		git.WithReceivePackHooks(ctx, req, "http"),
+		git.WithGitProtocol(ctx, req),
+		git.WithRefTxHook(ctx, req.Repository, config.Config),
+	)
 
 	if err != nil {
 		return status.Errorf(codes.Unavailable, "PostReceivePack: %v", err)
diff --git a/internal/gitaly/service/ssh/receive_pack.go b/internal/gitaly/service/ssh/receive_pack.go
index 4d62adaf0..d949eeb87 100644
--- a/internal/gitaly/service/ssh/receive_pack.go
+++ b/internal/gitaly/service/ssh/receive_pack.go
@@ -9,6 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/streamio"
@@ -65,10 +66,15 @@ func (s *server) sshReceivePack(stream gitalypb.SSHService_SSHReceivePackServer,
 		globalOpts = append(globalOpts, git.ValueFlag{"-c", o})
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout, Err: stderr}, nil, globalOpts, git.SubCmd{
-		Name: "receive-pack",
-		Args: []string{repoPath},
-	}, git.WithReceivePackHooks(ctx, req, "ssh"), git.WithGitProtocol(ctx, req))
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout, Err: stderr}, nil, globalOpts,
+		git.SubCmd{
+			Name: "receive-pack",
+			Args: []string{repoPath},
+		},
+		git.WithReceivePackHooks(ctx, req, "ssh"),
+		git.WithGitProtocol(ctx, req),
+		git.WithRefTxHook(ctx, req.Repository, config.Config),
+	)
 
 	if err != nil {
 		return fmt.Errorf("start cmd: %v", err)
diff --git a/internal/gitaly/service/ssh/receive_pack_test.go b/internal/gitaly/service/ssh/receive_pack_test.go
index 3dc204975..9647e74a4 100644
--- a/internal/gitaly/service/ssh/receive_pack_test.go
+++ b/internal/gitaly/service/ssh/receive_pack_test.go
@@ -177,7 +177,7 @@ func TestObjectPoolRefAdvertisementHidingSSH(t *testing.T) {
 	repo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	require.NoError(t, pool.Create(ctx, repo))
diff --git a/internal/helper/repo.go b/internal/helper/repo.go
index 5f8b502bc..afa7a689f 100644
--- a/internal/helper/repo.go
+++ b/internal/helper/repo.go
@@ -7,6 +7,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
+	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -74,3 +75,14 @@ func GetStorageByName(storageName string) (string, error) {
 
 	return storagePath, nil
 }
+
+// ProtoRepoFromRepo allows object pools and repository abstractions to be used
+// in places that require a concrete type
+func ProtoRepoFromRepo(repo repository.GitRepo) *gitalypb.Repository {
+	return &gitalypb.Repository{
+		StorageName:                   repo.GetStorageName(),
+		GitAlternateObjectDirectories: repo.GetGitAlternateObjectDirectories(),
+		GitObjectDirectory:            repo.GetGitObjectDirectory(),
+		RelativePath:                  repo.GetRelativePath(),
+	}
+}
diff --git a/internal/praefect/replicator_test.go b/internal/praefect/replicator_test.go
index 6eb2132ca..82bfb1697 100644
--- a/internal/praefect/replicator_test.go
+++ b/internal/praefect/replicator_test.go
@@ -96,7 +96,7 @@ func TestReplMgr_ProcessBacklog(t *testing.T) {
 
 	// create object pool on the source
 	objectPoolPath := testhelper.NewTestObjectPoolName(t)
-	pool, err := objectpool.NewObjectPool(gitaly_config.NewLocator(gitaly_config.Config), testRepo.GetStorageName(), objectPoolPath)
+	pool, err := objectpool.NewObjectPool(gitaly_config.Config, gitaly_config.NewLocator(gitaly_config.Config), testRepo.GetStorageName(), objectPoolPath)
 	require.NoError(t, err)
 
 	poolCtx, cancel := testhelper.Context()
diff --git a/internal/testhelper/testhelper.go b/internal/testhelper/testhelper.go
index 87c185baf..41b034aeb 100644
--- a/internal/testhelper/testhelper.go
+++ b/internal/testhelper/testhelper.go
@@ -660,7 +660,7 @@ func ListenGitalySSHCalls(t *testing.T, conf config.Cfg) (config.Cfg, func() []G
 					return nil
 				}
 
-				idx, err := strconv.Atoi(strings.TrimPrefix(filename, prefix))
+				idx, err := strconv.Atoi(strings.TrimSpace(strings.TrimPrefix(filename, prefix)))
 				if err != nil {
 					return err
 				}