Add optional pre-commit hook for code formatting #5178
4 issues
High
Pre-commit hook auto-formats unstaged files and may modify user's working tree - `.githooks/pre-commit:6-7`
The hook runs dotnet format (without --verify-no-changes), which mutates files in the working tree rather than just verifying. Combined with set -e, if formatting itself fails the hook aborts; but more critically, it formats the entire solution including unstaged changes the developer did not intend to commit. This causes side effects outside the commit's scope and can corrupt in-progress work, contradicting the PR description which states the hook should run dotnet format --verify-no-changes (check-only mode).
Also found at:
.githooks/pre-commit:6-9
Pre-commit hook modifies unstaged working-tree files and conflates them with staged changes - `.githooks/pre-commit:6-16`
The hook runs dotnet format against the entire working tree (not just staged content), then uses git diff (working tree vs index) to detect changes. This means: (1) it silently rewrites unstaged files the developer did not intend to commit, and (2) the failure path tells the developer to run git add -u, which would stage unrelated unstaged modifications along with formatting fixes. A developer with in-progress work in other files will have those files reformatted and potentially committed unintentionally.
Also found at:
.githooks/pre-commit:2-7.githooks/pre-commit:6-7
Medium
`set -e` causes the hook to exit silently when `dotnet format` returns non-zero - `.githooks/pre-commit:2-7`
With set -e at the top of the script, any non-zero exit from dotnet format (e.g., when --verify-no-changes is added, or when the tool encounters an error) will terminate the script immediately, bypassing the helpful error message block below. The user will see only the initial "🔍 Checking code formatting..." line and a failed commit with no explanation of how to fix it.
Low
Setup script does not ensure pre-commit hook is executable - `scripts/setup-hooks.sh:7`
The setup script configures core.hooksPath to .githooks but does not run chmod +x .githooks/pre-commit. If the file is checked out without the executable bit (e.g., on Windows filesystems, certain archive extractions, or if it was added to git without chmod +x before git add), the hook will silently fail to run and formatting checks will be skipped, defeating the purpose of the hook. Developers may believe formatting is being verified when it is not.
4 skills analyzed
| Skill | Findings | Duration | Cost |
|---|---|---|---|
| code-review | 2 | 47.1s | $0.25 |
| find-bugs | 2 | 39.3s | $0.36 |
| gha-security-review | 0 | 17.6s | $0.12 |
| security-review | 0 | 10.7s | $0.16 |
Duration: 1m 55s · Tokens: 233.7k in / 4.9k out · Cost: $0.91 (+extraction: $0.01, +merge: $0.00, +consolidate: $0.00, +dedup: $0.01, +fix_gate: $0.00)