Improving husky pre-commit hooks.

[bhouston]

Pre-commit Hook Configuration in the Project

Yes, the project does have pre-commit hooks set up that require the project to build successfully before changes are committed. Here's what I found:

Current Pre-commit Hook Setup

1. Husky Integration: The project uses Husky (v9.1.7) for Git hooks management, which was installed and configured on March 7, 2025.

2. Pre-commit Check Script: The pre-commit hook executes pnpm pre-commit-check, which is defined in package.json as:

   "pre-commit-check": "pnpm lint && pnpm build"

   This script runs both linting and a full build check before allowing commits.

3. Hook Location: The hook is properly set up in .husky/pre-commit.

Why Broken Builds Still Get Committed

After investigation, here are the likely reasons broken builds still get committed:

1. Git's --no-verify Flag: Developers can bypass pre-commit hooks using:

   git commit --no-verify -m "message"
   

2. Husky Version Inconsistency: There's a version mismatch in the Husky setup. The .git/hooks/pre-commit references Husky v4.3.8, while package.json has husky v9.1.7.

3. Package Manager Mismatch: The husky.local.sh specifies packageManager=npm, but the project uses pnpm, which could cause hook execution issues.

4. Hook Timing Issue: There appears to have been a re-installation of Git hooks right before the broken commit was made, which might have temporarily disabled the pre-commit check.

Recommendations

1. Enforce Hook Usage: Educate team members about not using --no-verify flag unless absolutely necessary.

2. Fix Husky Configuration:

   • Update husky.local.sh to use pnpm instead of npm
   • Reinstall Husky to ensure consistent versioning and proper hook setup

3. Add CI Validation: Implement the same build checks in CI/CD to catch issues even if pre-commit hooks are bypassed.

4. Consider Server-side Hooks: Add Git server-side hooks that cannot be bypassed by clients.

5. Add Hook Logging: Include logging in the pre-commit hook to track when it runs and its outcomes.

In summary, while the pre-commit hooks are configured to prevent broken builds from being committed, they can be bypassed, and there are configuration inconsistencies that might affect their reliability.