[rqbazan]

Summary

pnpm 10 blocks dependency build scripts by default, so pnpm install skipped lefthook's postinstall and a fresh clone had no git hooks.

 # pnpm-workspace.yaml
+allowBuilds:
+  lefthook: true
+
+# lefthook's postinstall installs the git hooks, so it has to run on every install:
+# with the side-effects cache on, a lefthook already built for another project skips it.
+sideEffectsCache: false
+
 # Supply-chain cooldown: ...
 minimumReleaseAge: 1440

• allowBuilds rather than the vland templates' onlyBuiltDependencies: the repo pins pnpm 10.30.3, allowBuilds is the preferred setting from 10.26, and pnpm 11 ignores onlyBuiltDependencies.
• sideEffectsCache: false follows the templates. Without it, a second clone on the same machine reuses the build from the store and skips the postinstall (see the control run below).
• docs/development.md drops the manual lefthook install step.

No changeset: the published package is unchanged.

Evidence

Each run is a fresh git clone followed by pnpm install --frozen-lockfile with pnpm 10.30.3 and Node 24.

• Before (main):

  Ignored build scripts: lefthook@2.1.9.
  .git/hooks: (only *.sample)
  

• Control (allowBuilds only, cache on, isolated store):

  clone 1: lefthook postinstall: sync hooks: ✔️(pre-commit, pre-push)   → pre-commit, pre-push
  clone 2: (no postinstall, lefthook comes from the store's side-effects cache)  → no hooks
  

• After (this branch, same store with lefthook already built, then the global store):

  lefthook postinstall: sync hooks: ✔️(pre-commit, pre-push)
  .git/hooks: pre-commit  pre-push          (both scripts call lefthook)
  git status: clean (no lockfile or pnpm-workspace.yaml changes)
  rr check: ✔ check passed
  pnpm test: 25 passed (25)
  git commit: 🥊 lefthook v2.1.9  hook: pre-commit
  

Merge Danger

Door: two-way

Revert the commit to go back to installing the hooks by hand.

Blast Radius: contributors

• Every local pnpm install now runs lefthook install -f, which overwrites any hand-made pre-commit or pre-push hook in .git/hooks.
• CI is unaffected: lefthook's postinstall exits early when CI is set.
• With sideEffectsCache: false, pnpm rebuilds dependencies that have build scripts on every install instead of reusing them from the store. lefthook is the only one that is allowed to build.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VFY4xrjKujVz6rsni1MJPm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 972cf68

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR