Add a regression test for git commit -a index corruption

crates/prek/tests/run.rs

@@ -2097,7 +2097,10 @@ fn git_commit_a() -> Result<()> {
     let filters = context
         .filters()
         .into_iter()
-        .chain([(r"\[master \w{7}\]", r"[master COMMIT]")])
+        .chain([
+            (r"\[master \w{7}\]", r"[master COMMIT]"),
+            ("7c8398204bbc95c33a6d2543f86a27621647cf78", "[HASH]"),
+        ])
         .collect::<Vec<_>>();
 
     cmd_snapshot!(filters, commit, @r"
@@ -2118,6 +2121,106 @@ fn git_commit_a() -> Result<()> {
     Ok(())
 }
 
+#[cfg(unix)]
+#[test]
+fn git_commit_a_currently_fails_when_hook_writes_to_temp_git_index() -> Result<()> {
+    let context = TestContext::new();
+    context.init_project();
+
+    // Repro for #1786 documenting the current behavior.
+    // `git commit -a` exports `GIT_INDEX_FILE=.git/index.lock` to the pre-commit hook
+    // process. If the hook inherits that env var and then runs a git command that writes
+    // to an index in a different repository, Git will write those entries into the parent
+    // repo's temporary index instead.
+    //
+    // The important detail is that the temp repo stages `file.txt`, matching a tracked
+    // path in the parent repo. That makes prek's post-hook `git diff` read the corrupted
+    // parent index entry and fail with `fatal: unable to read <hash>`.
+    context
+        .work_dir()
+        .child("hook.sh")
+        .write_str(indoc::indoc! {r#"
+        set -eu
+        tmpdir="$(mktemp -d)"
+        trap 'rm -rf "$tmpdir"' EXIT
+        cd "$tmpdir"
+        git init >/dev/null 2>&1
+        printf 'hook version\n' > file.txt
+        git add file.txt
+    "#})?;
+
+    context.write_pre_commit_config(indoc::indoc! {r"
+        repos:
+          - repo: local
+            hooks:
+              - id: write-temp-index
+                name: write-temp-index
+                language: system
+                entry: sh hook.sh
+                pass_filenames: false
+                always_run: true
+                verbose: true
+    "});
+
+    let cwd = context.work_dir();
+    let file = cwd.child("file.txt");
+    file.write_str("Hello, world!\n")?;
+
+    cmd_snapshot!(context.filters(), context.install(), @r#"
+    success: true
+    exit_code: 0
+    ----- stdout -----
+    prek installed at `.git/hooks/pre-commit`
+
+    ----- stderr -----
+    "#);
+
+    context.git_add(".");
+    context.git_commit("Initial commit");
+
+    // `git commit` does not set `GIT_INDEX_FILE`; `git commit -a` does.
+    // The repro only triggers on the `-a` path.
+    file.write_str("Hello again!\n")?;
+
+    let mut commit = git_cmd(cwd);
+    commit
+        .arg("commit")
+        .arg("-a")
+        .arg("-m")
+        .arg("Update file")
+        .env(EnvVars::PREK_HOME, &**context.home_dir());
+
+    let filters = context
+        .filters()
+        .into_iter()
+        .chain([
+            (r"\[master \w{7}\]", r"[master COMMIT]"),
+            (
+                r"fatal: unable to read [0-9a-f]{40}",
+                "fatal: unable to read [HASH]",
+            ),
+        ])
+        .collect::<Vec<_>>();
+
+    cmd_snapshot!(filters, commit, @r"
+    success: false
+    exit_code: 1
+    ----- stdout -----
+
+    ----- stderr -----
+    error: Command `git diff` exited with an error:
+
+    [status]
+    exit status: 128
+
+    [stderr]
+    fatal: unable to read [HASH]
+    "
+    );
+
+    Ok(())
+}
+
 fn write_pre_commit_config(path: &Path, hooks: &[(&str, &str)]) -> Result<()> {
     let mut yaml = String::from(indoc::indoc! {"
         repos: