Skip to content

simplify(pre-commit): remove stash logic

d0f43cf
Select commit
Loading
Failed to load commit list.
Open

Add optional pre-commit hook for code formatting #5178

simplify(pre-commit): remove stash logic
d0f43cf
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden completed May 3, 2026 in 1m 22s

4 issues

High

Pre-commit hook auto-formats unstaged files and may modify user's working tree - `.githooks/pre-commit:6-7`

The hook runs dotnet format (without --verify-no-changes), which mutates files in the working tree rather than just verifying. Combined with set -e, if formatting itself fails the hook aborts; but more critically, it formats the entire solution including unstaged changes the developer did not intend to commit. This causes side effects outside the commit's scope and can corrupt in-progress work, contradicting the PR description which states the hook should run dotnet format --verify-no-changes (check-only mode).

Also found at:

  • .githooks/pre-commit:6-9
Pre-commit hook modifies unstaged working-tree files and conflates them with staged changes - `.githooks/pre-commit:6-16`

The hook runs dotnet format against the entire working tree (not just staged content), then uses git diff (working tree vs index) to detect changes. This means: (1) it silently rewrites unstaged files the developer did not intend to commit, and (2) the failure path tells the developer to run git add -u, which would stage unrelated unstaged modifications along with formatting fixes. A developer with in-progress work in other files will have those files reformatted and potentially committed unintentionally.

Also found at:

  • .githooks/pre-commit:2-7
  • .githooks/pre-commit:6-7

Medium

`set -e` causes the hook to exit silently when `dotnet format` returns non-zero - `.githooks/pre-commit:2-7`

With set -e at the top of the script, any non-zero exit from dotnet format (e.g., when --verify-no-changes is added, or when the tool encounters an error) will terminate the script immediately, bypassing the helpful error message block below. The user will see only the initial "🔍 Checking code formatting..." line and a failed commit with no explanation of how to fix it.

Low

Setup script does not ensure pre-commit hook is executable - `scripts/setup-hooks.sh:7`

The setup script configures core.hooksPath to .githooks but does not run chmod +x .githooks/pre-commit. If the file is checked out without the executable bit (e.g., on Windows filesystems, certain archive extractions, or if it was added to git without chmod +x before git add), the hook will silently fail to run and formatting checks will be skipped, defeating the purpose of the hook. Developers may believe formatting is being verified when it is not.

4 skills analyzed
Skill Findings Duration Cost
code-review 2 47.1s $0.25
find-bugs 2 39.3s $0.36
gha-security-review 0 17.6s $0.12
security-review 0 10.7s $0.16

Duration: 1m 55s · Tokens: 233.7k in / 4.9k out · Cost: $0.91 (+extraction: $0.01, +merge: $0.00, +consolidate: $0.00, +dedup: $0.01, +fix_gate: $0.00)