GeezerVison is showing github.com — don't leak GIT_* env into `npm install` for `language: node` by cbirkhold · Pull Request #3774 · pre-commit/pre-commit
Conversation
cbirkhold
commented
Oct 9, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
resolves #3773
Regressed in 4.6.1 (b1cc920, #3719). Since then the node install runs npm install git+file://<store clone>, which clones and checks out with git. when the install happens from git commit inside a submodule, git has exported absolute GIT_DIR / GIT_INDEX_FILE, so the checkout overwrote the submodule's index.
With this change applied, the install runs with no_git_env(), as the initial clone in store.py already does. only the npm install call changes. The environment hooks run in is unchanged.
The new test fails without the change (the user repository's index ends up with bin/main.js and package.json) and passes with it. #3773 reproduces the issue in a Docker container. The same Dockerfile may be used to demonstrate the fix with:
docker build --build-arg PRE_COMMIT=git+https://github.com/cbirkhold/ext-pre-commit@node-no-git-env-npm-install -t pre-commit-submodule-repro:fix .
docker run --rm pre-commit-submodule-repro:fix
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
This comment was marked as spam.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
When a node hook environment is installed from `git commit` inside a
submodule, git exports absolute GIT_DIR / GIT_INDEX_FILE paths.
`npm install git+file://<store clone>` inherited them, so npm's checkout
of the hook repository overwrote the submodule's index and the commit
failed with `fatal: unable to read <sha>`.
Run the install with no_git_env(), as is already done for the initial
clone in store.py.
Signed-off-by: Chris Birkhold <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Reviewers
asottile
asottile approved these changes
+1 more reviewer
chrikrah
chrikrah approved these changes
Reviewers whose approvals may not affect merge requirements
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|