anthropics / anthropics/claude-code-action

Adding .husky to SENSITIVE_PATHS breaks repos that commit .husky files but not the hook setup

Open
#1,203 2 comments 0 reactions 0 assignees View on GitHub
area:permissions bug p2
Dominant language
TypeScript
Stars
8.9k
Forks
2.1k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

## Problem

PR #1174 added `.husky` to the `SENSITIVE_PATHS` list in `src/github/operations/restore-config.ts`. This causes the `.husky` directory to be restored/reset during the action, which breaks repositories that commit their `.husky` files but rely on `npx husky` being run to install the hooks.

After this change, pre-commit hooks no longer run because the hook setup is wiped and would need to be reinstalled via `npx husky`.

This is a regression from the previous behavior where `.husky` was not treated as a sensitive path.

## Context

See the discussion on #1174: https://github.com/anthropics/claude-code-action/pull/1174#discussion_r3058932921

## Expected Behavior

Repositories that commit `.husky` directory contents should continue to have their git hooks work as expected after the action runs.

## Suggested Fix

Either:
- Remove `.husky` from `SENSITIVE_PATHS`, or
- Only restore specific files within `.husky` that are security-sensitive (e.g., prevent the action from *adding* new hooks), rather than blanket-restoring the entire directory
- ask the model tu run `npx husky` or similar to re install correctly the hooks

Contributor guide

Open the contributing guide

Research direction

Start in src/github/operations/restore-config.ts at the SENSITIVE_PATHS handling, then review the discussion on PR #1174 for the regression context. Verify how restoring .husky affects committed hook files and define done as preserving repositories' existing hook setup without weakening the intended sensitive-path protection.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, typescript
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.