Pre-commit validation hook doesn't work with git worktrees

[will-langdale]

If you create a worktree then try to make a commit, the hook fails. Here's an example where I have a matchbox-2 worktree:

(matchbox-db) willlangdale@DBT001350 ~/D/matchbox-2 (bug/pool-adbc-location)> git commit -m "Clone ADBC connection in RelationalDBLocation."
ruff.....................................................................Passed
mkdocs...................................................................Passed
Alembic..................................................................Passed
Run a security scan......................................................Passed
Run a personal data scan.................................................Passed
Validate the security scan hook..........................................Failed
- hook id: validate-security-scan
- exit code: 1

Traceback (most recent call last):
  File "/app/.venv/bin/hooks-cli", line 10, in <module>
    sys.exit(main())
             ~~~~^^
  File "/app/.venv/lib/python3.13/site-packages/src/hooks/cli.py", line 114, in main
    anyio.run(main_async, argv)
    ~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/anyio/_core/_eventloop.py", line 75, in run
    return async_backend.run(func, args, {}, backend_options)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/anyio/_backends/_asyncio.py", line 2365, in run
    return runner.run(wrapper())
           ~~~~~~~~~~^^^^^^^^^^^
  File "/usr/local/lib/python3.13/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/local/lib/python3.13/asyncio/base_events.py", line 725, in run_until_complete
    return future.result()
           ~~~~~~~~~~~~~^^
  File "/app/.venv/lib/python3.13/site-packages/anyio/_backends/_asyncio.py", line 2348, in wrapper
    return await func(*args)
           ^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/src/hooks/cli.py", line 100, in main_async
    run_result = await hook.run()
                 ^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/src/hooks/validate_security_scan.py", line 57, in run
    with io.open(commit_msg_file, "r+", encoding="utf-8") as fd:
         ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/Users/willlangdale/Dev/matchbox/.git/worktrees/matchbox-2/COMMIT_EDITMSG'

This is because the path the hook is looking for should be in the original matchbox directory.

Suggest using git rev-parse --git-path to populate commit_msg_file in ValidateSecurityScan.run(), which should work from the worktree.

Worktrees are useful for doing minor bugfixes while working on a larger feature. They're also core to agent-heavy AI development workflows.

[chopkinsmade]

I've investigated this issue, and although I can see why it's happening it's unclear at the moment how to resolve it.

When the pre-commit hook is triggered, the repository source is mounted as a volume inside the docker container so the hook has access to the files needed for scanning. When using regular git branches and commits, this allows the docker container access to git commands such as git rev-parse --git-path and the COMMIT_EDITMSG file as the .git folder from the host machine is included in the mounted volume

When using the pre-commit hook with a git worktree, the worktree folder is the one mounted as a volume inside the container. This worktree folder does not contain a .git folder, and the COMMIT_EDITMSG file is created inside the worktree parent .git folder which is not available to the docker container.

The worktree folder does contain a .git file, which holds the full path to the parent .git folder where the COMMIT_EDITMSG file is created. For example:

gitdir: /Users/me/Documents/Projects/example-project/.git/worktrees/example-worktrees

Although the .git file is mounted inside the docker container and able to be read by the hook, as the folder referenced by the gitdir property exists on the host machine the docker container is unable to access it.

I will keep investigating a workaround for this issue