From b41d47675488203c6c691ee48ec1acab0bec0b2b Mon Sep 17 00:00:00 2001
From: Antoine Bolvy <antoine.bolvy@gmail.com>
Date: Tue, 21 Jul 2026 13:01:25 +0200
Subject: [PATCH] Permit `git cat-file` in pre-commit shim

---
 hooks/pre_commit_git_shim.sh | 1 +
 hooks/pre_commit_test.go     | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/hooks/pre_commit_git_shim.sh b/hooks/pre_commit_git_shim.sh
index 7a9e71d..3ba0800 100644
--- a/hooks/pre_commit_git_shim.sh
+++ b/hooks/pre_commit_git_shim.sh
@@ -3,6 +3,7 @@ set -e
 COMMAND=$1
 shift
 if
+    [ "$COMMAND" = "cat-file" ] ||
     [ "$COMMAND" = "diff" ] ||
     [ "$COMMAND" = "grep" ] ||
     [ "$COMMAND" = "ls-files" ] ||
diff --git a/hooks/pre_commit_test.go b/hooks/pre_commit_test.go
index f5b331c..442e80e 100644
--- a/hooks/pre_commit_test.go
+++ b/hooks/pre_commit_test.go
@@ -133,6 +133,9 @@ func TestGitShimAllowsReadonlyAccess(t *testing.T) {
 	tempDir := initGitForPreCommit(t)
 	tempDir.MkdirAll(".quickhook", "pre-commit")
 	tempDir.WriteFile([]string{".quickhook", "pre-commit", "accesses-git"}, "#!/bin/sh \n git status")
+	tempDir.WriteFile(
+		[]string{".quickhook", "pre-commit", "reads-blobs"},
+		"#!/bin/sh \n echo :0:example.txt | git cat-file --batch")
 
 	output, err := tempDir.ExecQuickhook("hook", "pre-commit")
 	assert.Nil(t, err)