Repository navigation
fix(ng-dev): disable git hooks when running git commands - #4006
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures Git to disable hooks during operations like checking out pull requests by setting core.hooksPath to devNull. The review feedback points out that using os.devNull will fail on Windows because Git's internal implementation strictly checks for the literal string '/dev/null'. It is recommended to use the literal string '/dev/null' directly and remove the unused devNull import from the os module.
e3732e7 to
4fc6b5f
Compare
alan-agius4
added
the
action: cleanup
alan-agius4
left a comment
alan-agius4
left a comment
There was a problem hiding this comment.
The approach makes sense. Passing -c core.hooksPath=... globally in GitClient.runGraceful alongside -c credential.helper= ensures git hooks won't run during automated operations (checkout, rebase, etc.) and protects against untrusted hooks in PR branches.
Left a couple of comments below.
alan-agius4
left a comment
alan-agius4
left a comment
There was a problem hiding this comment.
Please see the inline comments regarding using the literal '/dev/null' for cross-platform Git compatibility and adding a test to assert the injected flags.
4fc6b5f to
9fb8cba
Compare
alan-agius4
added
action: merge
`pr checkout` and `pr rebase` check out pull request content into the working tree. Where husky is installed `core.hooksPath` resolves to `.husky/_`, which lives inside the working tree and is untracked upstream, so a pull request can supply its own wrapper there and have it executed on checkout. Pass `core.hooksPath` on the command line alongside the existing `credential.helper` override, so hooks are disabled for every git invocation and the setting cannot be replaced by checked out content. `HUSKY=0` covers only the merge and release commands and relies on husky's own wrapper being present. Fixes angular#4005
e2bc555 to
321b902
Compare
|
This PR was merged into the repository. The changes were merged into the following branches:
|
|
Confirming identity for Google IssueTracker verification: report #559012933. |
2 participants
ng-dev pr checkoutandng-dev pr rebasecheck out pull request content into the user's workingtree. Where husky is installed — any workspace after
pnpm install, sincepackage.jsonhas"prepare": "husky"—core.hooksPathis.husky/_, which lives inside the working tree and isuntracked upstream (husky writes
.husky/_/.gitignorecontaining*). A pull request can thereforeadd its own
.husky/_/h, and checking that branch out replaces husky's generated wrapper, which gitthen runs:
post-checkouton both commands, pluspre-pushon the rebase path.mergePullRequestalready setsHUSKY=0for this reason, but that covers only the merge command andrelies on the wrapper being husky's own.
runGracefulis a better place for it — it already injects-c credential.helper=on every git invocation for a related reason, and config passed on thecommand line cannot be replaced by checked out content.
ng-dev/utils/test/git-client.spec.tsuses a mock git script that shifts past the injectedarguments, so it moves from
shift 2toshift 4.Verified against
a948cdfd:ng-dev pr checkoutotherwise behaves identicallyng-dev/utils/test/git-client.spec.ts— 14 specs, 0 failuresng-dev/pr/merge/strategies/strategy.spec.ts+ng-dev/pr/merge/integration.spec.ts— 41 specs, 0 failurestsc --noEmit -p tsconfig.json— pre-existing error count unchanged (1901 with and without)Fixes #4005
🤖 Generated with Claude Code