LTS pre-commit hook fails in git worktrees on non-core-web changes

[mbiuki]

Symptom

On both release-24.12.27_lts and release-25.07.10_lts, attempting to git commit a change outside the core-web/ subtree from inside a git worktree (as opposed to a normal clone) fails with:

[FIPS …] (irrelevant prelude truncated)
📁 Created temporary directory /var/folders/.../tmp.XXXXXX
💾 Backing up parent/pom.xml
fatal: /private/tmp/<worktree>/parent/pom.xml: '/private/tmp/<worktree>/parent/pom.xml' is outside repository at '/private/tmp/<worktree>/core-web'
husky - pre-commit hook exited with code 128 (error)

The hook never reaches its actual lint/format work — it dies in the file-backup step.

Root cause

In core-web/.husky/pre-commit:

• Line 355 cd "${core_web_dir}" || exit 1 switches cwd to core-web/.
• Line 387 git restore "${root_dir}/${file}" then invokes git from inside core-web/, passing an absolute path to a file outside that subtree.

In a normal clone this is harmless: git's repo-discovery walks up from cwd and finds the .git/ directory at the repo root, and git restore operates on the absolute path correctly.

In a git worktree the calling git commit sets GIT_DIR to an absolute path (e.g. /Users/.../core/.git/worktrees/<name>). That env var is inherited by the hook process and every subprocess. When git is then invoked from core-web/ with GIT_DIR already set, git skips its normal .git discovery and infers GIT_WORK_TREE from cwd → core-web/. The absolute path argument .../<worktree>/parent/pom.xml is then judged "outside repository at .../core-web", producing the fatal.

The same dependency on cwd applies to the other in-hook git add / git restore calls in perform_frontend_fixes (lines 132, 150, 167) — anywhere the hook passes an absolute path while running from a different cwd in a worktree.

Main branch is not affected — its hook is a different version with a graceful skip when the toolchain isn't bootstrapped.

Reproduction

cd ~/path/to/dotCMS/core
git worktree add -b feature/example /tmp/lts-wt origin/release-25.07.10_lts
cd /tmp/lts-wt
# touch any non-core-web file and stage it
echo '<!-- test -->' >> parent/pom.xml
git add parent/pom.xml
git commit -m "test"
# → husky pre-commit dies as above

Impact

• Breaks the standard worktree-based development workflow for LTS branches.
• Forced workaround for security: upgrade Apache Tomcat from 9.0.113 to 9.0.118 (25.07.10 LTS backport) #35797 and security: upgrade Apache Tomcat from 9.0.113 to 9.0.118 (24.12.27 LTS backport) #35798 (Tomcat bump backports): use fresh shallow clones rather than worktrees. Slower, more disk, no git worktree list traceability.
• Will block any future LTS backports done via worktrees until fixed.

Proposed fix

Replace the cwd-dependent absolute-path git invocations with git -C "${root_dir}" form, which is unambiguous regardless of cwd or GIT_DIR. Minimal patch:

- git restore "${root_dir}/${file}"
+ git -C "${root_dir}" restore -- "${file}"

- if ! git add -- "${root_dir}/${file}"; then
+ if ! git -C "${root_dir}" add -- "${file}"; then

- git restore "${file}"
+ git -C "${root_dir}" restore -- "${file}"

- git add "${root_dir}/core-web/yarn.lock"
+ git -C "${root_dir}" add -- "core-web/yarn.lock"

(Exact line numbers in core-web/.husky/pre-commit.)

Branches that need the fix:

• release-25.07.10_lts
• release-24.12.27_lts

main is unaffected.

Suggested companion improvement (out of scope here)

The hook's cd "${core_web_dir}" exists so that yarn / nx commands resolve relative to core-web/. After this fix, that cd is still needed for those subcommands, but the hook should treat the cd as a local scope rather than a global state change — easy to confirm with a comment near the cd line.