[theCodeDrift]

Keeps .husky/pre-commit byte-identical to taskless/taskless#426 and taskless/marketing#88, which changed the shared body again.

The bug it fixes elsewhere: a repo that installs the worktrees-pnpm skill through dotagents skips that install under CI (postinstall checks $CI). On a runner the guard file may not exist, and #603's missing-file check then blocks every automated commit before the guard's own GITHUB_ACTIONS skip can run. The new body wraps the check and the guard in if [ "${GITHUB_ACTIONS:-}" != "true" ].

taskless/cli is not affected: the skill is tracked in git here, so the guard always exists on a runner. The body is adopted anyway so the three repos stay identical. SKILL.md's snippet matches it byte for byte and explains why the check sits inside the test.

Measured in a scratch repo, as a raw git hook with lint-staged stubbed to pass:

Guard file	Case	Result
present	primary checkout	refused
present	primary, CI=1	refused
present	GITHUB_ACTIONS=true	commits
present	worktree	commits
missing	GITHUB_ACTIONS=true	commits
missing	local	refused, with the install hint

No changeset: repo tooling, nothing ships.

[theCodeDrift]

@claude /review

[github-actions]

Claude finished @theCodeDrift's task in 1m 45s —— View job

---

Review complete

• Read .prior-review.json (workflow data, not reviewed as PR content)
• Fetch PR diff, commits, and changed files via gh
• Read .husky/pre-commit, .agents/skills/worktrees-pnpm/SKILL.md, and refuse-main-checkout.sh for full context
• Review diff for correctness, security, clarity
• Post final assessment

Review mode: incremental — read 0 prior review thread(s) before reviewing. .prior-review.json contains no reviewThreads and no reviews, only the triggering @claude /review comment, so this is the first review of this PR — there is nothing previously raised to carry forward.

Assessment

Traced the new control flow against refuse-main-checkout.sh's own GITHUB_ACTIONS exemption and against the PR's test matrix — it checks out:

• GITHUB_ACTIONS=true: the new outer if [ "${GITHUB_ACTIONS:-}" != "true" ] skips the missing-file check and the guard invocation entirely, falling through to pnpm exec lint-staged. This is consistent with the guard script itself already exiting 0 on GITHUB_ACTIONS=true — the outer wrap just prevents the missing-file branch (added in chore: share one pre-commit body with cloud and marketing #603) from firing before the guard's own exemption gets a chance to run when the file isn't there.
• Guard present, not on Actions: behavior is unchanged — sh "$guard" || exit 1 still runs, so the primary-checkout refusal and --no-verify escape hatch are untouched.
• Guard missing, not on Actions: still refused with the install hint, same as before.

One behavioral note, not a bug: this does slightly widen what GITHUB_ACTIONS=true bypasses — previously the missing-file check ran unconditionally, so deleting the guard file and setting GITHUB_ACTIONS=true locally would still refuse; now it falls through to lint-staged. That's an intentional consequence of the fix (described in the guard script's own comments on why it keys on GITHUB_ACTIONS rather than CI), not a new gap introduced here — restating it only because it's the one edge the PR's test table doesn't enumerate.

.husky/pre-commit and the SKILL.md fenced snippet match byte-for-byte, and the new prose paragraph in SKILL.md explaining why the check sits inside the GITHUB_ACTIONS test reads clearly. No build/lint/test run performed, per review instructions — CI reports that separately.

No correctness, security, or clarity issues found. Nothing to flag inline.

[theCodeDrift]

Re: @github-actions — "Claude finished @theCodeDrift's task in 1m 45s … Review complete"
#604 (comment)

No findings. The widened edge you noted (guard deleted plus GITHUB_ACTIONS=true set locally) is already a named bypass in AGENTS.md and the skill, which forbid an agent from setting GITHUB_ACTIONS to get past the guard. Merging.

— AI Coding Agent