Checking if a file is generated during pre-commit succeeds even when a generated file exists

[antikhv]

In our repo, we are generating server types from an OpenAPI spec and then checking if a file was generated by using git diff. We have a pre-commit hook that checks whether the generation command makes a change and then failing the hook if a file was changed. When running this via hk, the hook passes even when it should have failed. These are my tasks

[tasks."spec:build"]
run = "openapi-ts"

[tasks."spec:check"]
run = '''
mise run src:spec:build
if git diff --quiet --exit-code ./routes; then
    echo "All good, no need to regenerate the openapi spec."
else
    echo "Change detected. Re-run mise run src:spec:build and commit the results." >&2
    exit 1
fi
'''

This is my hk file

amends "package://github.com/jdx/hk/releases/download/v1.52.0/hk@1.52.0#/Config.pkl"
import "package://github.com/jdx/hk/releases/download/v1.52.0/hk@1.52.0#/Builtins.pkl"

local linters = new Mapping<String, Step> {
    ["src:spec:check"] {
        check = "mise run src:spec:check"
    }
}

hooks {
    ["pre-commit"] {
        stash = "git"
        steps = linters
    }
}

and this is my package.json (minimal ofc)

{
  "private": true,
  "type": "module",
  "module": "index.ts",
  "dependencies": {
    "fastify": "^5.10.0",
    "fastify-openapi-glue": "^4.11.3"
  },
  "devDependencies": {
    "@hey-api/openapi-ts": "^0.99.0",
    "typescript": "5.9.3"
  },
}

I can workaround the issue by unsetting the GIT_ env vars hk adds.

[tasks."spec:check"]
run = '''
mise run src:spec:build
if env -u GIT_DIR -u GIT_INDEX_FILE -u GIT_WORK_TREE git diff --quiet --exit-code ./routes; then
    echo "All good, no need to regenerate the openapi spec."
else
    echo "Change detected. Re-run mise run src:spec:build and commit the results." >&2
    exit 1
fi
'''

But I would like to not do this. I use Git worktrees if that has an impact. Removing the stash does not fix the problem.

[jdx]

Thanks for the detailed report. I tried reproducing this with the same basic pattern (a pre-commit check that modifies a tracked generated file and then runs git diff --quiet -- <output-dir>) in a linked worktree. With hk 1.53.0, the diff returned non-zero and hk correctly rejected the commit.

One important detail is that these variables are supplied by Git to hooks, rather than created by hk. hk preserves them because they identify the repository and, importantly, the index that is actually being committed. GIT_INDEX_FILE can point to a temporary index for operations such as git commit -a or commits with explicit paths. Unsetting it can therefore make the nested git diff inspect a different index, which explains why that changes the result but may not be the correct behavior for a pre-commit hook. The stash setting is independent of this, so removing stash = "git" would not be expected to change it.

Could you share the exact commit command or Git client you use, along with the output of the following from inside the failing task?

printf 'pwd=%s\n' "$PWD"
git --version
env | sort | grep '^GIT_'
git rev-parse --show-toplevel --git-dir --git-path index
git status --short
git diff --name-status -- ./routes
env -u GIT_DIR -u GIT_INDEX_FILE -u GIT_WORK_TREE \
  git diff --name-status -- ./routes

The two git diff outputs, together with the index paths, should show whether the successful check is reading a temporary or different worktree index. It would also help to know whether the generated paths are already tracked and staged when the hook runs.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[antikhv]

No it still doesn't work without the env stuff. I changed my task to the following now

[tasks."spec:check"]
depends = ["spec:build"]
run = '''
untracked=$(git ls-files --others --exclude-standard -- ":(top)src/generated")
if git diff --quiet --exit-code -- ":(top)src/generated" && [ -z "$untracked" ]; then
    echo "All good, no need to regenerate the openapi spec."
else
    echo "Change detected. Re-run mise run src:spec:build and commit the results." >&2
    exit 1
fi
'''

And while this worked when running mise run //src:spec:check and hk check, running the pre-commit hook still failed and I had to add the env -u GIT_DIR -u GIT_INDEX_FILE -u GIT_WORK_TREE command to both untracked and the if block. For reference, this is my hk.pkl

amends "package://github.com/jdx/hk/releases/download/v1.52.0/hk@1.52.0#/Config.pkl"
import "package://github.com/jdx/hk/releases/download/v1.52.0/hk@1.52.0#/Builtins.pkl"

local linters = new Mapping<String, Step> {
    ["actions:lint"] {
        check = "mise run actions:lint"
    }
    ["src:fmt"] {
        check = "mise run //src:fmt"
        fix = "mise run //src:fmt:fix"
    }

    ["src:lint"] {
        check = "mise run //src:lint"
        fix = "mise run //src:lint:fix"
    }
    ["terraform:fmt:check"] {
        check = "mise run //terraform:fmt:check"
    }
    ["secrets:check"] {
        check = "mise run secrets:check"
    }
    ["secrets:scan"] {
        check = "mise run secrets:scan"
    }
    ["src:spec:check"] {
        check = "mise run //src:spec:check"
    }
}

hooks {
    ["pre-commit"] {
        stash = "git"
        steps = linters
    }
    ["fix"] {
        fix = true
        steps = linters
    }
    ["check"] {
        steps = linters
    }
}

[antikhv]

I'm debugging the why of that command currently

[antikhv]

I made a couple of mistakes when running the diagnostic commands. Notably, I ran them using mise run ... and hk pre-commit but did not run them through the actual pre-commit. When running through the full cycle i.e. git commit ... I have the following output (sanitized and cut down from all steps to only spec:check):

  src:spec:check – [//src:spec:build:gmk-search-routes] [Job 1] 🧹 Running Oxfmt
  src:spec:check – [//src:spec:build:gmk-search-routes] [Job 1] ✓ /Users/vibhor/repos/edtelligent-gmk-search/story/edt-1511/src/generated/gmk_search_routes · 3 files · 25ms
  src:spec:check – [//src:spec:build:gmk-search-routes] Finished in 523.3ms
  src:spec:check – [//src:spec:build:directus-client] [Job 1] 🧹 Running Oxfmt
  src:spec:check – [//src:spec:build:directus-client] [Job 1] ✓ /Users/vibhor/repos/edtelligent-gmk-search/story/edt-1511/src/generated/directus_client · 4 files · 924ms
  src:spec:check – [//src:spec:build:directus-client] Finished in 1.43s
  src:spec:check – [//src:spec:check] $ printf 'pwd=%s\n' "$PWD"
  src:spec:check – [//src:spec:check] pwd=/repos/edtelligent-gmk-search/story/edt-1511/src
  src:spec:check – [//src:spec:check] git version 2.50.1 (Apple Git-155)
  src:spec:check – [//src:spec:check] GIT_AUTHOR_DATE=@1786716439 +0200
  src:spec:check – [//src:spec:check] GIT_AUTHOR_EMAIL=vibhor.kainth@edtelligent.de
  src:spec:check – [//src:spec:check] GIT_AUTHOR_NAME=Vibhor Kainth
  src:spec:check – [//src:spec:check] GIT_DIR=/Users/vibhor/repos/edtelligent-gmk-search/main/.git/worktrees/edt-1511
  src:spec:check – [//src:spec:check] GIT_EDITOR=:
  src:spec:check – [//src:spec:check] GIT_EXEC_PATH=/Library/Developer/CommandLineTools/usr/libexec/git-core
  src:spec:check – [//src:spec:check] GIT_INDEX_FILE=/repos/edtelligent-gmk-search/main/.git/worktrees/edt-1511/index
  src:spec:check – [//src:spec:check] GIT_PREFIX=
  src:spec:check – [//src:spec:check] /repos/edtelligent-gmk-search/story/edt-1511/src
  src:spec:check – [//src:spec:check] /repos/edtelligent-gmk-search/main/.git/worktrees/edt-1511
  src:spec:check – [//src:spec:check] /repos/edtelligent-gmk-search/main/.git/worktrees/edt-1511/index
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/client.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/client/client.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/client/index.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/client/types.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/client/utils.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/auth.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/bodySerializer.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/params.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/pathSerializer.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/queryKeySerializer.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/serverSentEvents.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/types.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/core/utils.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/index.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/sdk.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/directus_client/types.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/elasticsearch/index_courses.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/gmk_search_routes/fastify.gen.ts
  src:spec:check – [//src:spec:check]  D src/generated/gmk_search_routes/index.ts
  src:spec:check – [//src:spec:check]  D src/generated/gmk_search_routes/types.gen.ts
  src:spec:check – [//src:spec:check] ?? .dockerignore
  src:spec:check – [//src:spec:check] ?? .oxfmtrc.json
  src:spec:check – [//src:spec:check] ?? .oxlintrc.json
  src:spec:check – [//src:spec:check] ?? .vscode/settings.json
  src:spec:check – [//src:spec:check] ?? Dockerfile
  src:spec:check – [//src:spec:check] ?? adapters/
  src:spec:check – [//src:spec:check] ?? apiHandlers.ts
  src:spec:check – [//src:spec:check] ?? app.ts
  src:spec:check – [//src:spec:check] ?? bun.lock
  src:spec:check – [//src:spec:check] ?? config.ts
  src:spec:check – [//src:spec:check] ?? generated/
  src:spec:check – [//src:spec:check] ?? index.ts
  src:spec:check – [//src:spec:check] ?? ingestion/
  src:spec:check – [//src:spec:check] ?? node_modules/
  src:spec:check – [//src:spec:check] ?? package.json
  src:spec:check – [//src:spec:check] ?? plugins/
  src:spec:check – [//src:spec:check] ?? repositories/
  src:spec:check – [//src:spec:check] ?? specs/
  src:spec:check – [//src:spec:check] ?? tsconfig.json
  src:spec:check – [//src:spec:check] All good, no need to regenerate the openapi spec.
  src:spec:check – [//src:spec:check] Finished in 104.4ms
  src:spec:check – Finished in 1.58s
✔ src:spec:check

Sorry for the earlier misdiagnostic. Claude suggests the following:

Root cause: git sets GIT_DIR/GIT_INDEX_FILE for hook subprocesses but never GIT_WORK_TREE; since the task runs from src/ (a subdir of the repo root), git fell back to treating src/ as the worktree root, misaligning every path by one directory level and making the whole tree look deleted+untracked

Admittedly, I don't know much about Git internals and this just flew past me.

[jdx]

That diagnosis is correct. Git starts a non-bare hook at the worktree root, where GIT_DIR without GIT_WORK_TREE is valid. hk then runs the scoped step from src/, so nested Git commands treat that directory as the worktree root and misalign the index paths.

I opened #1200 to fix this in hk. It makes the resolved worktree root explicit as GIT_WORK_TREE while preserving GIT_INDEX_FILE, since that can identify the temporary index actually being committed. The regression test exercises a real commit from a linked worktree with the step scoped to a subdirectory, in both libgit2 modes.

Thanks for tracking down the full-hook diagnostic, and sorry for the earlier misdiagnoses.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.