anthropics / anthropics/claude-code-action
Adding .husky to SENSITIVE_PATHS breaks repos that commit .husky files but not the hook setup
- Dominant language
- TypeScript
- Stars
- 8.9k
- Forks
- 2.1k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 10
Description
## Problem
PR #1174 added `.husky` to the `SENSITIVE_PATHS` list in `src/github/operations/restore-config.ts`. This causes the `.husky` directory to be restored/reset during the action, which breaks repositories that commit their `.husky` files but rely on `npx husky` being run to install the hooks.
After this change, pre-commit hooks no longer run because the hook setup is wiped and would need to be reinstalled via `npx husky`.
This is a regression from the previous behavior where `.husky` was not treated as a sensitive path.
## Context
See the discussion on #1174: https://github.com/anthropics/claude-code-action/pull/1174#discussion_r3058932921
## Expected Behavior
Repositories that commit `.husky` directory contents should continue to have their git hooks work as expected after the action runs.
## Suggested Fix
Either:
- Remove `.husky` from `SENSITIVE_PATHS`, or
- Only restore specific files within `.husky` that are security-sensitive (e.g., prevent the action from *adding* new hooks), rather than blanket-restoring the entire directory
- ask the model tu run `npx husky` or similar to re install correctly the hooks
Contributor guide
Research direction
Start in src/github/operations/restore-config.ts at the SENSITIVE_PATHS handling, then review the discussion on PR #1174 for the regression context. Verify how restoring .husky affects committed hook files and define done as preserving repositories' existing hook setup without weakening the intended sensitive-path protection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, typescript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100