What this prompt does
This prompt sets up a comprehensive Git hooks system for a [language]/[framework] project using your [hook_manager]. It wires a pre-commit hook that runs [linter] on staged files only, auto-formats with [formatter] and re-stages the changes, scans for secrets with [secret_scanner], and blocks [anti_patterns] before anything reaches a commit. The whole system is tuned to stay fast enough that the team keeps it switched on.
It works because catching a leaked credential or an unformatted file locally beats fixing it in review. The commit-msg hook validates against your [commit_convention], a pre-push hook runs [pre_push_checks], and a post-merge hook reinstalls dependencies when the lockfile changes. Crucially, it keeps total hook time under [max_time] seconds via staged-files-only scope, parallel execution, and caching. It includes a documented skip mechanism for genuine emergencies and mirrors the same checks in CI so a local bypass still gets caught downstream.
When to use it
- You want to catch lint, format, and secret issues before they land, not in review
- Standardising commit messages against a
[commit_convention]like Conventional Commits - Blocking
[anti_patterns]such as stray console.log, debugger, or test .only - Running heavier
[pre_push_checks](type-check, unit tests) before code leaves a machine - You need hooks fast enough that the team won't disable them
- Mirroring local checks in CI so someone can't quietly bypass the hooks
Example output
You get all config files plus setup instructions: [hook_manager] configuration, a pre-commit hook running [linter] and [formatter] on staged files with re-staging, secret scanning via [secret_scanner], anti-pattern checks for [anti_patterns], a commit-msg validator for [commit_convention], a pre-push hook running [pre_push_checks], a post-merge dependency-install hook, parallelised execution tuned to stay under [max_time] seconds, a documented emergency skip, and a CI mirror of the same checks.
Pro tips
- Keep the linter and formatter scoped to staged files; running them on the whole project is the main reason hooks get slow and disabled
- Set
[max_time]to a number developers will tolerate (around ten seconds) and rely on parallel execution and caching to hit it - List real
[anti_patterns]for your stack (console.log, debugger, hardcoded localhost) so the checks block what actually causes problems - Treat
[secret_scanner]as a safety net, not a guarantee; rotate any credential that ever reaches a commit regardless of the scan result - Validate commit messages against
[commit_convention]so downstream automation like semantic versioning has clean input to work from - Document when the skip mechanism is acceptable so it's used for genuine emergencies, not as a routine shortcut around the gates
- Use the post-merge hook to reinstall dependencies when the lockfile changes, so teammates don't run against a stale node_modules after a pull
- Mirror the hooks in CI so a local bypass still fails the pipeline and nothing slips through to the main branch
