Git Hooks Patterns

---
name: git-hooks-patterns
description: >
  Use for hooks/, InstallGitHooks, staged check orchestration, or sensitive
  pattern/allowlist behavior. Not for general CI workflow changes.
---

# Git Hooks Patterns

## Installation

`InstallGitHooks` discovers extensionless files under `hooks/` through injected
`FileSystemOps` and copies them into `.git/hooks/`. Keep filesystem access out
of applicability checks. Cross-domain dependency wiring belongs in the app
catalog.

## Pre-commit contract

`hooks/pre-commit` is a POSIX `sh` orchestrator:

- `check-sensitive.sh` scans staged diffs.
- `check-rust.sh` runs staged Rust/script checks.
- `check-ci-guards.sh` adds targeted CI parity when
  `DOTFILES_HOOKS_FULL=1`.

Keep the hook and its integration test synchronized when adding a helper.
Installed hooks are copies, so rerun install after editing.

## Sensitive patterns

- Detection rules live in `hooks/sensitive-patterns.ini`; safe-span exceptions
  live in `hooks/sensitive-allowlist.ini`.
- Patterns and allowlists are extended regular expressions.
- Match contextual indicators, not generic secret-like strings.
- Allowlist only the safe span; the remainder of the line must still be scanned.
- Prefer a narrow allowlist entry to weakening detection or recommending
  `--no-verify`.
- Test both directions: the false positive clears and a real secret on the same
  line remains detected.

The full hook integration script creates commits and requires a clean scratch
repository; do not run it against a dirty checkout.

Use `shell-patterns` for POSIX conventions and `ci-cd-patterns` when changing CI
parity scope.