Add optional pre-commit hook for code formatting #5178
3 issues
find-bugs: Found 3 issues (1 high, 2 medium)
High
`set -e` plus failed `dotnet format` causes silent abort leaving stash unrestored - `.githooks/pre-commit:11-13`
With set -e at the top, if dotnet format exits non-zero (e.g., compile error, missing SDK, network issue during restore), the script terminates immediately at line 12. The stash pop on lines 22-24 is never reached, leaving the developer's unstaged changes trapped in the stash with a confusing name. The user sees no error message because stdout/stderr are redirected to /dev/null.
Also found at:
.githooks/pre-commit:9-19
Medium
Glob pattern `./**/*OptionsSetup.cs` is shell-expanded before being passed to dotnet format - `.githooks/pre-commit:12-13`
Bash will expand ./**/*OptionsSetup.cs (with globstar potentially disabled) and ./modules before invoking dotnet format. Without shopt -s globstar, ** is treated as *, so the exclude argument passed to dotnet format may not match the intended files. Additionally, multiple matched files become multiple positional arguments, which --exclude may not accept. This means CI and the hook can diverge in what files they exclude, defeating the stated goal of matching CI exactly.
Stash pop conflict can leave repository in inconsistent state without notifying developer - `.githooks/pre-commit:22-24`
On line 23, git stash pop --quiet 2>/dev/null || true swallows any conflict that occurs when reapplying unstaged changes. If dotnet format modified files that the developer also had unstaged edits to, the pop will conflict and leave the stash in place — but the script reports success (or the formatting failure) and never tells the developer their unstaged work is still stashed.
Duration: 47.7s · Tokens: 50.1k in / 2.1k out · Cost: $0.45 (+merge: $0.00)
Annotations
Check failure on line 13 in .githooks/pre-commit
sentry-warden / warden: find-bugs
`set -e` plus failed `dotnet format` causes silent abort leaving stash unrestored
With `set -e` at the top, if `dotnet format` exits non-zero (e.g., compile error, missing SDK, network issue during restore), the script terminates immediately at line 12. The stash pop on lines 22-24 is never reached, leaving the developer's unstaged changes trapped in the stash with a confusing name. The user sees no error message because stdout/stderr are redirected to `/dev/null`.
Check failure on line 19 in .githooks/pre-commit
sentry-warden / warden: find-bugs
[96D-DV3] `set -e` plus failed `dotnet format` causes silent abort leaving stash unrestored (additional location)
With `set -e` at the top, if `dotnet format` exits non-zero (e.g., compile error, missing SDK, network issue during restore), the script terminates immediately at line 12. The stash pop on lines 22-24 is never reached, leaving the developer's unstaged changes trapped in the stash with a confusing name. The user sees no error message because stdout/stderr are redirected to `/dev/null`.
Check warning on line 13 in .githooks/pre-commit
sentry-warden / warden: find-bugs
Glob pattern `./**/*OptionsSetup.cs` is shell-expanded before being passed to dotnet format
Bash will expand `./**/*OptionsSetup.cs` (with globstar potentially disabled) and `./modules` before invoking `dotnet format`. Without `shopt -s globstar`, `**` is treated as `*`, so the exclude argument passed to dotnet format may not match the intended files. Additionally, multiple matched files become multiple positional arguments, which `--exclude` may not accept. This means CI and the hook can diverge in what files they exclude, defeating the stated goal of matching CI exactly.
Check warning on line 24 in .githooks/pre-commit
sentry-warden / warden: find-bugs
Stash pop conflict can leave repository in inconsistent state without notifying developer
On line 23, `git stash pop --quiet 2>/dev/null || true` swallows any conflict that occurs when reapplying unstaged changes. If `dotnet format` modified files that the developer also had unstaged edits to, the pop will conflict and leave the stash in place — but the script reports success (or the formatting failure) and never tells the developer their unstaged work is still stashed.