Project 5: Git Hooks Framework — Build Your Own Husky

A Git hooks management system (like Husky, but from scratch) that allows configuring pre-commit, pre-push, and commit-msg hooks via a config file, with support for running multiple scripts per hook.

Quick Reference

Attribute Value
Difficulty Intermediate
Time Estimate 1 week
Main Programming Language Bash/Python
Alternative Programming Languages Go, Rust, Node.js
Coolness Level Level 3: Genuinely Clever
Business Potential 3. The “Service & Support” Model
Prerequisites Shell scripting, understanding of Git basics
Key Topics Available Git Hooks, Hook Execution Context, Exit Codes

1. Learning Objectives

By completing this project, you will:

  1. Implement a working version of: A Git hooks management system (like Husky, but from scratch) that allows configuring pre-commit, pre-push, and commit-msg hooks via a config file, with support for running multiple scripts per hook..
  2. Explain the core Git workflow tradeoff this project is designed to surface.
  3. Design deterministic checks so results can be verified and reproduced.
  4. Document operational failure modes and safe recovery actions.

2. All Theory Needed (Per-Concept Breakdown)

Available Git Hooks

Fundamentals This concept matters in this project because your implementation will fail or become non-deterministic without a precise model of Available Git Hooks. You should define what the concept controls, what invariants must hold, and which actions are safe versus destructive. Treat this concept as a production concern, not a tutorial checkbox.

Deep Dive into the concept When applying Available Git Hooks in this project, reason in three passes: data shape, state transitions, and enforcement. First, identify which artifacts are authoritative (commit objects, refs, metadata, policy config, CI status, or scan findings). Second, map how those artifacts change when your tool runs. Third, define failure behavior explicitly. In Git tooling, silent partial success is dangerous: you need either complete success with evidence or an explicit failure state with remediation guidance. Also account for scale behavior. A workflow that works on a toy repo may fail on large history depth, concurrent updates, or mixed branch policies. Include trace logs for every irreversible action, and separate simulation mode from write mode. For interview readiness, be able to explain how this concept protects delivery speed while reducing operational risk.

How this fit on projects In this project, Available Git Hooks is directly used in design decisions, implementation constraints, and verification criteria.

Definitions & key terms

  • Available Git Hooks invariant: A condition that must remain true before and after every operation.
  • Safety boundary: The point where actions become destructive unless guarded.
  • Verification signal: Evidence proving the action behaved as expected.

Mental model diagram

Input state -> Validate invariant -> Apply change -> Verify output -> Record evidence

How it works

  1. Capture current state and constraints.
  2. Evaluate whether Available Git Hooks preconditions are satisfied.
  3. Execute the minimal safe transition.
  4. Verify postconditions and publish an auditable result.

Failure modes: stale state, partial writes, race conditions, ambiguous output contracts.

Minimal concrete example

Plan -> dry-run -> execute -> verify -> rollback/forward-fix decision

Common misconceptions

  • Assuming local success implies team-safe behavior.
  • Treating policy violations as warnings instead of merge blockers.
  • Skipping deterministic verification because the output appears correct.

Check-your-understanding questions

  1. Which invariant is most likely to break first under concurrency?
  2. What output proves your tool handled an edge case correctly?
  3. Where should enforcement happen: local hook, CI, or protected branch gate?

Check-your-understanding answers

  1. The invariant tied to mutable refs or policy-dependent merge eligibility.
  2. A deterministic transcript showing both success and controlled failure behavior.
  3. Layered enforcement: fast local checks plus non-bypassable server-side gates.

Real-world applications

  • Change-management tooling for fast-moving teams.
  • Incident-safe release workflows with traceable rollback paths.
  • Compliance-ready source-control automation.

Where you’ll apply it This project and its immediate adjacent projects in this sprint.

References

  • https://git-scm.com/docs
  • https://dora.dev/capabilities/trunk-based-development/

Key insights Available Git Hooks is only valuable when its invariants are encoded into tooling and checks.

Summary Mastering Available Git Hooks here gives you transferable patterns for larger workflow systems.

Homework/Exercises to practice the concept

  1. Write one failing scenario and expected detection output.
  2. Define one invariant and one explicit violation test.

Solutions to the homework/exercises

  1. Use a stale branch or invalid metadata case and assert deterministic error reporting.
  2. Invariant: protected branch must not accept unchecked changes; violation test: bypass attempt should fail fast.

Hook Execution Context

Fundamentals This concept matters in this project because your implementation will fail or become non-deterministic without a precise model of Hook Execution Context. You should define what the concept controls, what invariants must hold, and which actions are safe versus destructive. Treat this concept as a production concern, not a tutorial checkbox.

Deep Dive into the concept When applying Hook Execution Context in this project, reason in three passes: data shape, state transitions, and enforcement. First, identify which artifacts are authoritative (commit objects, refs, metadata, policy config, CI status, or scan findings). Second, map how those artifacts change when your tool runs. Third, define failure behavior explicitly. In Git tooling, silent partial success is dangerous: you need either complete success with evidence or an explicit failure state with remediation guidance. Also account for scale behavior. A workflow that works on a toy repo may fail on large history depth, concurrent updates, or mixed branch policies. Include trace logs for every irreversible action, and separate simulation mode from write mode. For interview readiness, be able to explain how this concept protects delivery speed while reducing operational risk.

How this fit on projects In this project, Hook Execution Context is directly used in design decisions, implementation constraints, and verification criteria.

Definitions & key terms

  • Hook Execution Context invariant: A condition that must remain true before and after every operation.
  • Safety boundary: The point where actions become destructive unless guarded.
  • Verification signal: Evidence proving the action behaved as expected.

Mental model diagram

Input state -> Validate invariant -> Apply change -> Verify output -> Record evidence

How it works

  1. Capture current state and constraints.
  2. Evaluate whether Hook Execution Context preconditions are satisfied.
  3. Execute the minimal safe transition.
  4. Verify postconditions and publish an auditable result.

Failure modes: stale state, partial writes, race conditions, ambiguous output contracts.

Minimal concrete example

Plan -> dry-run -> execute -> verify -> rollback/forward-fix decision

Common misconceptions

  • Assuming local success implies team-safe behavior.
  • Treating policy violations as warnings instead of merge blockers.
  • Skipping deterministic verification because the output appears correct.

Check-your-understanding questions

  1. Which invariant is most likely to break first under concurrency?
  2. What output proves your tool handled an edge case correctly?
  3. Where should enforcement happen: local hook, CI, or protected branch gate?

Check-your-understanding answers

  1. The invariant tied to mutable refs or policy-dependent merge eligibility.
  2. A deterministic transcript showing both success and controlled failure behavior.
  3. Layered enforcement: fast local checks plus non-bypassable server-side gates.

Real-world applications

  • Change-management tooling for fast-moving teams.
  • Incident-safe release workflows with traceable rollback paths.
  • Compliance-ready source-control automation.

Where you’ll apply it This project and its immediate adjacent projects in this sprint.

References

  • https://git-scm.com/docs
  • https://dora.dev/capabilities/trunk-based-development/

Key insights Hook Execution Context is only valuable when its invariants are encoded into tooling and checks.

Summary Mastering Hook Execution Context here gives you transferable patterns for larger workflow systems.

Homework/Exercises to practice the concept

  1. Write one failing scenario and expected detection output.
  2. Define one invariant and one explicit violation test.

Solutions to the homework/exercises

  1. Use a stale branch or invalid metadata case and assert deterministic error reporting.
  2. Invariant: protected branch must not accept unchecked changes; violation test: bypass attempt should fail fast.

Exit Codes

Fundamentals This concept matters in this project because your implementation will fail or become non-deterministic without a precise model of Exit Codes. You should define what the concept controls, what invariants must hold, and which actions are safe versus destructive. Treat this concept as a production concern, not a tutorial checkbox.

Deep Dive into the concept When applying Exit Codes in this project, reason in three passes: data shape, state transitions, and enforcement. First, identify which artifacts are authoritative (commit objects, refs, metadata, policy config, CI status, or scan findings). Second, map how those artifacts change when your tool runs. Third, define failure behavior explicitly. In Git tooling, silent partial success is dangerous: you need either complete success with evidence or an explicit failure state with remediation guidance. Also account for scale behavior. A workflow that works on a toy repo may fail on large history depth, concurrent updates, or mixed branch policies. Include trace logs for every irreversible action, and separate simulation mode from write mode. For interview readiness, be able to explain how this concept protects delivery speed while reducing operational risk.

How this fit on projects In this project, Exit Codes is directly used in design decisions, implementation constraints, and verification criteria.

Definitions & key terms

  • Exit Codes invariant: A condition that must remain true before and after every operation.
  • Safety boundary: The point where actions become destructive unless guarded.
  • Verification signal: Evidence proving the action behaved as expected.

Mental model diagram

Input state -> Validate invariant -> Apply change -> Verify output -> Record evidence

How it works

  1. Capture current state and constraints.
  2. Evaluate whether Exit Codes preconditions are satisfied.
  3. Execute the minimal safe transition.
  4. Verify postconditions and publish an auditable result.

Failure modes: stale state, partial writes, race conditions, ambiguous output contracts.

Minimal concrete example

Plan -> dry-run -> execute -> verify -> rollback/forward-fix decision

Common misconceptions

  • Assuming local success implies team-safe behavior.
  • Treating policy violations as warnings instead of merge blockers.
  • Skipping deterministic verification because the output appears correct.

Check-your-understanding questions

  1. Which invariant is most likely to break first under concurrency?
  2. What output proves your tool handled an edge case correctly?
  3. Where should enforcement happen: local hook, CI, or protected branch gate?

Check-your-understanding answers

  1. The invariant tied to mutable refs or policy-dependent merge eligibility.
  2. A deterministic transcript showing both success and controlled failure behavior.
  3. Layered enforcement: fast local checks plus non-bypassable server-side gates.

Real-world applications

  • Change-management tooling for fast-moving teams.
  • Incident-safe release workflows with traceable rollback paths.
  • Compliance-ready source-control automation.

Where you’ll apply it This project and its immediate adjacent projects in this sprint.

References

  • https://git-scm.com/docs
  • https://dora.dev/capabilities/trunk-based-development/

Key insights Exit Codes is only valuable when its invariants are encoded into tooling and checks.

Summary Mastering Exit Codes here gives you transferable patterns for larger workflow systems.

Homework/Exercises to practice the concept

  1. Write one failing scenario and expected detection output.
  2. Define one invariant and one explicit violation test.

Solutions to the homework/exercises

  1. Use a stale branch or invalid metadata case and assert deterministic error reporting.
  2. Invariant: protected branch must not accept unchecked changes; violation test: bypass attempt should fail fast.

3. Project Specification

3.1 What You Will Build

A Git hooks management system (like Husky, but from scratch) that allows configuring pre-commit, pre-push, and commit-msg hooks via a config file, with support for running multiple scripts per hook.

3.2 Functional Requirements

  1. Scope control: Deliver a deterministic and testable implementation.
  2. Correctness: Preserve Git invariants and policy constraints.

3.3 Non-Functional Requirements

  • Performance: Deterministic execution with documented runtime behavior on representative history sizes.
  • Reliability: Repeated runs on the same input produce identical outputs.
  • Usability: Clear CLI or report output for both success and failure cases.

3.4 Example Usage / Output

You’ll have a hooks framework that your team can use:

Example Output:

$ cat .git-hooks.yaml
hooks:
  pre-commit:
    - name: "Format check"
      run: "npm run format:check"
    - name: "Lint"
      run: "npm run lint"
    - name: "Type check"
      run: "npm run typecheck"

  commit-msg:
    - name: "Conventional commit"
      run: "./scripts/check-commit-msg.sh"

  pre-push:
    - name: "Tests"
      run: "npm test"
    - name: "Build"
      run: "npm run build"

$ ./hooks-manager install
Installing hooks framework...
✓ Created .git/hooks/pre-commit
✓ Created .git/hooks/commit-msg
✓ Created .git/hooks/pre-push
Hooks installed successfully!

$ git commit -m "bad commit"
Running pre-commit hooks...
[1/3] Format check... ✓ (0.5s)
[2/3] Lint... ✗ FAILED (1.2s)

Error: ESLint found 3 errors:
  src/index.ts:15 - Unexpected any type
  src/utils.ts:8 - Missing return type
  src/utils.ts:22 - Unused variable 'temp'

Pre-commit hook failed. Commit aborted.
Fix the issues above or use --no-verify to skip hooks.

$ # Fix issues...
$ git commit -m "feat: add user authentication"
Running pre-commit hooks...
[1/3] Format check... ✓ (0.5s)
[2/3] Lint... ✓ (1.1s)
[3/3] Type check... ✓ (2.3s)

Running commit-msg hooks...
[1/1] Conventional commit... ✓ (0.1s)

[feature 3a4b5c6] feat: add user authentication
 3 files changed, 127 insertions(+)

3.5 Data Formats / Schemas / Protocols

Describe input repository assumptions, output report shape, and any policy/config schema consumed by the tool.

3.6 Edge Cases

  • Empty repository or shallow clone state.
  • Detached HEAD or rewritten history during execution.
  • Invalid metadata/policy configuration.

3.7 Real World Outcome

You’ll have a hooks framework that your team can use:

Example Output:

$ cat .git-hooks.yaml
hooks:
  pre-commit:
    - name: "Format check"
      run: "npm run format:check"
    - name: "Lint"
      run: "npm run lint"
    - name: "Type check"
      run: "npm run typecheck"

  commit-msg:
    - name: "Conventional commit"
      run: "./scripts/check-commit-msg.sh"

  pre-push:
    - name: "Tests"
      run: "npm test"
    - name: "Build"
      run: "npm run build"

$ ./hooks-manager install
Installing hooks framework...
✓ Created .git/hooks/pre-commit
✓ Created .git/hooks/commit-msg
✓ Created .git/hooks/pre-push
Hooks installed successfully!

$ git commit -m "bad commit"
Running pre-commit hooks...
[1/3] Format check... ✓ (0.5s)
[2/3] Lint... ✗ FAILED (1.2s)

Error: ESLint found 3 errors:
  src/index.ts:15 - Unexpected any type
  src/utils.ts:8 - Missing return type
  src/utils.ts:22 - Unused variable 'temp'

Pre-commit hook failed. Commit aborted.
Fix the issues above or use --no-verify to skip hooks.

$ # Fix issues...
$ git commit -m "feat: add user authentication"
Running pre-commit hooks...
[1/3] Format check... ✓ (0.5s)
[2/3] Lint... ✓ (1.1s)
[3/3] Type check... ✓ (2.3s)

Running commit-msg hooks...
[1/1] Conventional commit... ✓ (0.1s)

[feature 3a4b5c6] feat: add user authentication
 3 files changed, 127 insertions(+)

4. Solution Architecture

4.1 High-Level Design

Inputs -> Validation -> Core Engine -> Output Formatter -> Verification Report

4.2 Key Components

Component Responsibility Key Decisions
Input loader Discover commits/refs/config inputs Deterministic ordering and clear failure messages
Core engine Compute project-specific logic Separate read-only simulation from mutating actions
Reporter Produce user-facing output and evidence Include machine-readable and human-readable forms

4.4 Data Structures (No Full Code)

ProjectState { refs, commits, policy, findings, metrics }
Result { status, evidence, warnings, next_actions }

4.4 Algorithm Overview

  1. Collect state from repository and configuration.
  2. Evaluate invariants and policy preconditions.
  3. Execute core transformation or analysis logic.
  4. Verify postconditions and emit deterministic report.

Complexity Analysis:

  • Time: O(history + affected scope)
  • Space: O(active graph window + report size)

5. Implementation Guide

5.1 Development Environment Setup

Use the environment defined in the main guide. Pin tool versions and fixture data to keep outputs reproducible.

5.2 Project Structure

project-root/
├── fixtures/
├── src/
├── tests/
├── docs/
└── README.md

5.3 The Core Question You’re Answering

“How do teams enforce code quality automatically, and why can’t Git hooks be shared through the repository?”

Before you write any code, sit with this question. The .git directory is not tracked by Git itself, so hooks don’t travel with the repo. This is why tools like Husky exist—to bridge tracked config files with untracked hook scripts.

5.4 Concepts You Must Understand First

Stop and research these before coding:

  1. Available Git Hooks
    • What hooks exist (pre-commit, commit-msg, pre-push, post-merge, etc.)?
    • What arguments does each hook receive?
    • What does the exit code mean for each hook?
    • Book Reference: “Pro Git” Ch. 8.3 — Chacon
  2. Hook Execution Context
    • What’s the working directory when a hook runs?
    • What environment variables are available?
    • How do you access staged changes vs. working directory?
    • Book Reference: “Pro Git” Ch. 8.3 — Chacon
  3. Exit Codes
    • How do exit codes control whether Git proceeds?
    • How do you propagate failures from child processes?
    • What exit codes should your framework use?
    • Book Reference: “The Linux Command Line” Ch. 27 — Shotts

5.5 Questions to Guide Your Design

Before implementing, think through these:

  1. Configuration
    • Where will the config file live (.git-hooks.yaml, .hooks/, package.json)?
    • How will users specify multiple scripts per hook?
    • How will you handle hook arguments and stdin?
  2. Installation
    • How will you install hooks to .git/hooks/?
    • How will you avoid overwriting user’s custom hooks?
    • How will you handle reinstallation on config changes?
  3. Execution
    • How will you run multiple scripts and aggregate results?
    • Should scripts run in parallel or serial?
    • How will you display progress and output?

5.6 Thinking Exercise

Explore Git Hooks

Set up and test hooks manually:

git init hook-test && cd hook-test
echo "initial" > file.txt && git add . && git commit -m "init"

# Create a failing pre-commit hook
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/bash
echo "Pre-commit hook running..."
echo "Checking for TODO comments..."
if grep -r "TODO" .; then
    echo "ERROR: Found TODO comments!"
    exit 1
fi
echo "All clear!"
exit 0
EOF
chmod +x .git/hooks/pre-commit

# Test it
echo "// TODO: fix this" >> file.txt
git add file.txt
git commit -m "test"  # Should fail!

Questions while exploring:

  • What exit code caused the commit to fail?
  • What’s in $GIT_INDEX_FILE during the hook?
  • Try git commit --no-verify — what happens?
  • Check what’s passed via stdin to commit-msg

5.7 The Interview Questions They’ll Ask

Prepare to answer these:

  1. “How would you enforce that all commits pass linting before being pushed?”
  2. “Why can’t you just add your hooks to .git/hooks/ and commit them?”
  3. “What’s the difference between pre-commit and pre-push hooks?”
  4. “How would you skip hooks for a work-in-progress commit?”
  5. “How do commit-msg hooks work, and how would you enforce conventional commits?”

5.8 Hints in Layers

Hint 1: Starting Point Your installed hook script should: read config file, determine which scripts to run, run them in order, and exit 0 only if all succeed.

Hint 2: Config Parsing YAML is nice for config. In bash, you might use simpler formats or shell out to Python for parsing.

Hint 3: Hook Arguments For commit-msg, argument 1 is the path to the message file. For pre-push, stdin contains lines with local/remote refs.

Hint 4: Progress Display Use ANSI colors and \r to overwrite lines. Show [1/3] Linting... then update to [1/3] Linting... ✓

5.9 Books That Will Help

Topic Book Chapter
Git hooks “Pro Git” by Chacon Ch. 8.3
Shell scripting “The Linux Command Line” by Shotts Ch. 24-27
Process management “The Linux Programming Interface” by Kerrisk Ch. 24-28

5.10 Implementation Phases

Phase 1: Foundation (1-2 sessions)

  • Define fixtures, expected outputs, and invariant checks.
  • Build read-only analysis path.

Phase 2: Core Functionality (2-4 sessions)

  • Implement project-specific core logic and deterministic reporting.
  • Add policy and edge-case handling.

Phase 3: Polish and Edge Cases (1-2 sessions)

  • Add failure demos, performance notes, and usability improvements.
  • Finalize docs and validation transcripts.

5.11 Key Implementation Decisions

Decision Options Recommendation Rationale
Execution mode direct write vs dry-run+write dry-run+write Safer and easier to debug
Output contract free text vs structured+text structured+text Better automation and readability
Enforcement location local only vs local+CI local+CI Prevents bypass in shared branches

6. Testing Strategy

6.1 Test Categories

  • Unit tests for parsing and policy logic.
  • Integration tests on fixture repositories.
  • Edge-case tests for stale refs, malformed metadata, and large histories.

6.2 Critical Test Cases

  1. Deterministic golden-path scenario.
  2. Policy violation hard-fail scenario.
  3. Recovery path after partial or conflicting state.

6.3 Test Data

Use fixed repository fixtures with known commit graphs and expected outputs stored under version control.

7. Common Pitfalls & Debugging

Problem 1: “Output looks correct but history or metadata is inconsistent”

  • Why: Validation happens after mutation, not before.
  • Fix: Add a preflight invariant check and a post-write verification step.
  • Quick test: Run the same command twice on the same fixture and verify identical results.

Problem 2: “Tool works on small repo but times out on larger history”

  • Why: Full traversal is performed where selective traversal is possible.
  • Fix: Cache intermediate graph lookups and scope analysis to affected commits/paths.
  • Quick test: Compare runtime on small and large fixtures with a clear budget target.

Problem 3: “Policy check can be bypassed by local-only behavior”

  • Why: Enforcement is advisory, not server-authoritative.
  • Fix: Mirror critical checks in CI and protected branch rules.
  • Quick test: Attempt merge with failing policy in CI and confirm hard block.

8. Extensions & Challenges

8.1 Beginner Extensions

  • Add richer error messages with remediation hints.
  • Add fixture generation helpers for repeatable demos.

8.2 Intermediate Extensions

  • Add performance instrumentation and budget assertions.
  • Add policy configuration profiles by repository type.

8.3 Advanced Extensions

  • Add distributed execution support for large repositories.
  • Add signed evidence exports for compliance workflows.

9. Real-World Connections

9.1 Industry Applications

  • Internal developer portals.
  • Enterprise repository governance systems.
  • Release safety and incident diagnostics tooling.
  • Git core: https://git-scm.com/
  • GitHub CLI: https://github.com/cli/cli
  • pre-commit framework: https://pre-commit.com/

9.3 Interview Relevance

This project prepares you for architecture and debugging interviews that focus on merge policy, CI gates, and workflow reliability tradeoffs.

10. Resources

10.1 Essential Reading

  • Pro Git (Internals and Workflows chapters)
  • Software Engineering at Google (Version control and build chapters)
  • Accelerate (delivery performance practices)

10.2 Video Resources

  • Git internals talks from Git Merge conference archives.
  • DORA and delivery metrics conference sessions.

10.3 Tools and Documentation

  • https://git-scm.com/docs
  • https://docs.github.com/
  • https://dora.dev/

11. Self-Assessment Checklist

11.1 Understanding

  • I can explain the primary invariant this project enforces.
  • I can explain one failure mode and one safe recovery path.

11.2 Implementation

  • Functional requirements are met on deterministic fixtures.
  • Critical edge cases are tested and documented.

11.3 Growth

  • I can describe tradeoffs in an interview setting.
  • I documented what I would change in a production version.

12. Submission / Completion Criteria

Minimum Viable Completion:

  • Deterministic golden-path output exists.
  • One failure scenario is handled with clear output.
  • Core workflow objective is demonstrably met.

Full Completion:

  • Minimum criteria plus policy validation, structured reporting, and edge-case coverage.

Excellence:

  • Full completion plus measurable performance budget and production-hardening notes.