Re: [RFC] Optional per-repository consent before running local hooks

From: Junio C Hamano <gitster@pobox.com>
Date: Sep 29, 2026, 18:27 UTC
Message-ID: <xmqqjyo3hq0y.fsf@gitster.g>
In-Reply-To: <CAF1QGTmK=WY_AODsfETOtzOSuwpZ_4KV5SiNPoRv0SAYeJ7T5A@mail.gmail.com>

Dmytro Lymarenko <dmytro.lymarenko@gmail.com> writes:

Show 12 quoted lines

> I’d like to propose an optional safety setting for Git hooks. When
> enabled, Git would check for an active hook before running it in a
> repository that the user has not approved. It would show the hook’s
> path and ask whether to run it once, trust the current hooks for this
> repository, or decline.
> This would help when a tool or setup step installs hooks from files
> supplied by a project. The check should happen immediately before
> execution, so it also covers hooks installed after a repository was
> cloned. For scripts inside the working tree, Git should ask again if
> the approved script changes.
> The default behavior could remain unchanged, with this protection
> enabled by an explicit user setting.

One thing that immediately comes to mind is that, if the "tool or setup step" is allowed to install hooks from files supplied by a project, it is unclear what prevents it from also approving these hooks on the user's behalf (or, rather, leaving the same "clue" that your proposed mechanism uses to record that the user approved execution of these hooks).