Install Git pre-commit hooks to enforce checks in Copilot agent environment

[Copilot]

Instructing the Copilot agent via .github/copilot-instructions.md to run pre-commit checks was unreliable - the agent would sometimes forget or skip checks. This enforces pre-commit checks mechanistically via Git hooks instead of instructionally.

Changes

• scripts/install-git-hooks.sh: Creates symlink from .git/hooks/pre-commit → scripts/pre-commit.sh

  • Validates environment (.git exists, source script exists)
  • Removes existing hooks before linking
  • Idempotent - safe to run multiple times

• .github/workflows/copilot-setup-steps.yml: Added hook installation step after dependency setup

How it works

# Copilot environment setup
./scripts/install-git-hooks.sh

# When agent commits
git commit -m "feat: something"
# → Hook automatically runs scripts/pre-commit.sh
# → Blocks commit if checks fail

Symlink approach ensures hook always uses latest version of scripts/pre-commit.sh without reinstallation.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 10.228.208.161
  • Triggering command: ssh -i /home/REDACTED/work/torrust-tracker-deployer/torrust-tracker-deployer/fixtures/testing_rsa -p 22 -o StrictHostKeyChecking=no -o ConnectTimeout=5 -o UserKnownHostsFile=/dev/null torrust@10.228.208.161 echo 'SSH connected' (packet block)
  • Triggering command: ssh -i /home/REDACTED/work/torrust-tracker-deployer/torrust-tracker-deployer/fixtures/testing_rsa -p 22 -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -o StrictHostKeyChecking=no torrust@10.228.208.161 echo 'SSH connected' (packet block)
  • Triggering command: ssh -i /home/REDACTED/work/torrust-tracker-deployer/torrust-tracker-deployer/fixtures/testing_rsa -p 22 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=5 torrust@10.228.208.161 echo 'SSH connected' (packet block)
• 192.0.2.1
  • Triggering command: ssh -i /nonexistent/key -p 22 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 testuser@192.0.2.1 echo 'SSH connected' (packet block)
  • Triggering command: ssh -i /nonexistent/key -p 22 -o ConnectTimeout=5 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null testuser@192.0.2.1 echo 'SSH connected' (packet block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Install Git Pre-Commit Hooks for Copilot Agent</issue_title>
<issue_description>Parent Epic: #112 - Refactor and Improve E2E Test Execution
Depends On: #120 - Configure GitHub Copilot Agent Environment (Issue 1-4)

Overview

Install Git pre-commit hooks in the Copilot agent's environment to enforce pre-commit checks deterministically. This ensures the agent cannot commit code without running linting checks, even if the agent forgets or ignores the instruction in .github/copilot-instructions.md.

Problem

Previous attempts to instruct the Copilot agent to run pre-commit checks via .github/copilot-instructions.md were not reliable. The agent sometimes:

• Forgot to run checks before committing
• Ignored the instructions
• Committed code that failed linting

Solution: Use Git hooks to enforce checks mechanistically, not instructionally.

Objectives

• Create symlink from .git/hooks/pre-commit to ./scripts/pre-commit.sh
• Install hook in Copilot setup workflow
• Verify hook works correctly (blocks bad commits)
• Document the hook installation process

Implementation Approach

Use Symlink (NOT Wrapper Script):

ln -sf ../../scripts/pre-commit.sh .git/hooks/pre-commit

Why Symlink:

• ✅ Simple - no wrapper script needed
• ✅ Always up-to-date - changes to script are immediately reflected
• ✅ Single source of truth - ./scripts/pre-commit.sh
• ✅ Easy to verify - readlink .git/hooks/pre-commit

Workflow Integration

Add to .github/workflows/copilot-setup-steps.yml:

- name: Install Git pre-commit hooks
  run: |
    # Create symlink to enforce pre-commit checks
    ln -sf ../../scripts/pre-commit.sh .git/hooks/pre-commit
    chmod +x .git/hooks/pre-commit
    
    # Verify hook is installed
    if [ -L .git/hooks/pre-commit ]; then
      echo "✅ Pre-commit hook installed successfully"
      readlink .git/hooks/pre-commit
    else
      echo "❌ Failed to install pre-commit hook"
      exit 1
    fi

Acceptance Criteria

• Pre-commit checks pass
• Hook installation added to Copilot setup workflow
• Hook successfully blocks commits that fail checks
• Hook is verified during workflow execution
• Documentation updated

Time Estimate

2-3 hours

Related Documentation

• Full specification: docs/issues/121-1-5-install-git-precommit-hooks-for-copilot.md
• Removed Integration Test Commit: e9955b0</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Install Git Pre-Commit Hooks for Copilot Agent #121

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[josecelano]

ACK 3ef2e15