[kyle-sexton]

No related issue: main-red flake fix, reported by a peer session from run https://github.com/melodic-software/claude-code-plugins/actions/runs/40069911482

Summary

lib/git-hooks/install.test.mjs "plan returns the remotes: entry and lefthook install, and writes nothing" failed on main at 033368d. The only difference between its before and after .git snapshots was .git/objects/maintenance.lock. Likely cause (UNVERIFIED): a detached git maintenance --auto spawned by the fixture's seed commit was holding the lock during the first read and had released it by the second. This is a race in the test fixture, not a defect in plan.

Fix

Every git the test spawns now runs with maintenance.auto=false and gc.auto=0, set through GIT_CONFIG_COUNT next to the existing GIT_CONFIG_GLOBAL/GIT_CONFIG_NOSYSTEM isolation. This removes the cause instead of teaching the snapshot to ignore lock files.

Verification

• bash lib/git-hooks/install.test.sh: 62 pass, 0 fail (git 2.53.0).
• Left out: a reproduction of the race. It depends on timing, and CI's test-bash lane re-runs the suite on every push.

Related

• feat(guardrails): serve the git hooks to lefthook repositories as a remote #9504, chore(git-hooks): run the guardrails git hooks from this repository's lefthook remote #9563 (remote-hook mode and its tests)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T06:39:23.937640Z	ea6a24b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed ea6a24b1c1492283777ad4f7f954b0e37339172d: 0 finding(s), 0 as inline comments.

I found no security issues in this pull request.

The only change is to the test fixture lib/git-hooks/install.test.mjs. It sets maintenance.auto=false and gc.auto=0 through GIT_CONFIG_COUNT and the matching key and value variables, next to the existing GIT_CONFIG_GLOBAL and GIT_CONFIG_NOSYSTEM isolation. The values are fixed constants, so no untrusted input reaches them. The change doesn't touch shipped code, a manifest, a workflow, an instruction surface or a trust-gate path. The PR context contained no embedded directives.

critical-findings: 0

[github-actions]

claude-review reviewed ea6a24b1c1492283777ad4f7f954b0e37339172d: 0 finding(s), 0 as inline comments.

No findings. I reviewed the single-file change to lib/git-hooks/install.test.mjs against the diff and PR context. I only read the code. I ran no tests, and the "62 pass, 0 fail" result is the PR author's claim, which I have not verified.

• gitEnv is spread into baseEnv, so every git() helper call and the other spawns that pass env: baseEnv get maintenance.auto=false and gc.auto=0 through GIT_CONFIG_COUNT. This removes the cause the author suspects for the .git/objects/maintenance.lock difference. That cause is unverified, and the PR says so.
• Object.assign(process.env, gitEnv) also covers git processes spawned by the code under test, which inherit process.env.
• The withGlobal and locked-global tests override only GIT_CONFIG_GLOBAL on process.env and then restore it. GIT_CONFIG_COUNT does not interact with them, because it sets different keys, and they read and write the global file with --file or --global.
• The PR changes no manifests, closes no issue, and touches no hold class, so there is no hold.