Wait, I thought git hooks aren't pulled from remote.
Wouldn't untrusted git hooks mean that git verify-* are useless since you're already running untrusted code?
Just to react to:
>Wait, I thought git hooks aren't pulled from remote.
You are correct. They are not. Other tools may auto-install them (I hate it), but git does not ever.
On my current app we use husky which installs hooks when you do a yarn install
You are in luck, it seems: https://blog.typicode.com/husky-git-hooks-autoinstall/
(Though not completely sure.)
Git hooks have always been sketchy as hell.
Can't stand the Mac specific shit my co-workers keep dumping in there.