feat(terraform_validate): Add support for running hook in git worktree

hooks/_common.sh

@@ -116,6 +116,44 @@ function common::parse_cmdline {
   done
 }
 
+#######################################################################
+# Scrub some GIT_* env vars before child Git operations.
+#
+# Without this, `git commit` from a linked Git worktree fails at
+# tree-build when a hook runs `tofu init` / `terraform init` (which
+# spawns `git clone` for each Git-sourced module):
+#
+#   error: invalid object 100644 <oid> for '<path>'
+#   error: Error building trees
+#
+# Root cause: the child `git clone` inherits GIT_INDEX_FILE from the
+# parent `git commit` env (pointing at the worktree's index), then
+# writes the cloned module's blob OIDs into the parent worktree's
+# index. The subsequent commit cannot resolve those OIDs.
+#
+# pre-commit scrubs GIT_* only for its own internal Git calls, not
+# for hook subprocesses - hook authors are expected to handle it
+# themselves: https://github.com/pre-commit/pre-commit/issues/1849
+#
+# This is a targeted denylist, NOT a mirror of pre-commit's
+# allowlist-based `no_git_env` helper
+# (https://github.com/pre-commit/pre-commit/blob/main/pre_commit/git.py),
+# which drops all GIT_* except known-safe vars (GIT_ASKPASS,
+# GIT_CONFIG_*, GIT_SSH, GIT_SSH_COMMAND, GIT_SSL_*, etc.). We unset
+# only the vars that leak the parent repository's location into child
+# Git processes (see "Environment Variables" in `man 1 git`,
+# https://git-scm.com/docs/git#_environment_variables):
+#
+#   GIT_DIR               makes child Git operate on the parent repo
+#   GIT_INDEX_FILE        proximate cause of the failure above
+#   GIT_OBJECT_DIRECTORY  redirects child object writes into the
+#                         parent object database
+#   GIT_WORK_TREE         pairs with GIT_DIR
+#######################################################################
+function common::scrub_git_env {
+  unset GIT_DIR GIT_INDEX_FILE GIT_OBJECT_DIRECTORY GIT_WORK_TREE
+}
+
 #######################################################################
 # Expand environment variables definition into their values in '--args'.
 # Support expansion only for ${ENV_VAR} vars, not $ENV_VAR.

hooks/terraform_validate.sh

@@ -15,6 +15,7 @@ function main {
   common::parse_cmdline "$@"
   common::export_provided_env_vars "${ENV_VARS[@]}"
   common::parse_and_export_env_vars
+  common::scrub_git_env
 
   # Suppress terraform validate color
   if [ "$PRE_COMMIT_COLOR" = "never" ]; then