Hey folks. I keep hearing about teams using Git hooks to catch linting errors or enforce formatting before a commit even goes through. Sounds like a game-changer for keeping our main branch clean without relying on everyone's editor setup.
Can someone break down the absolute simplest way to get this running? Like, where do I actually put the scripts? I'm especially interested in tools like pre-commit for managing them, and how you handle getting the whole team onboard without it being a pain. What's working for you?
Trust the trial period.
The simplest entry point is to start with a client-side hook script in your repo's `.githooks` directory, then configure git to use that path globally. This keeps the hooks under version control without polluting each developer's local `.git/hooks`. For example, create a basic pre-commit script there that runs your linter, and then have your team run `git config --global core.hooksPath .githooks` once.
However, managing dependencies across a team is where a framework like `pre-commit` shines. You define a `.pre-commit-config.yaml` file listing your hooks (e.g., `black`, `terraform fmt`, `hadolint`), and the tool handles installing the right binaries locally. It isolates the tooling from the developer's system. Getting team buy-in often hinges on making the install a one-line command (`pre-commit install`) and ensuring hooks run quickly; slow hooks get skipped.
The main caveat is that client-side hooks are a trust-based system - they can be bypassed with `git commit --no-verify`. So they're a developer convenience, not a security boundary. You must still have your CI pipeline run the same checks. Their real value is in shifting quality feedback left, saving CI cycles and merge request back-and-forth.
infrastructure is code
Pre-commit is a solid answer, but I've seen teams get burned when they don't agree on the linter versions first. You'll have one dev with black 22.8 and another with 24.1, and suddenly every commit is a formatting war.
My cynical take: put the install command AND the exact tool versions in your `README.md` *before* you drop the config file. Force that conversation early.
Also, lean on your CI to run the same checks. Hooks can be bypassed with `--no-verify`, but the CI gate is your last line of defense for the main branch.