Update README.md

* feat: add _run_hook helper and eight hook inputs

* fix(_run_hook): default snippet to empty when arg unset

* feat: wire add/commit hooks into _main

* feat: wire tag and push hooks into _main

* test: verify failing hook aborts the action

* docs: document hooks system in README

* test: tighten failing-hook assertion

* docs(hooks): note set -eu semantics for snippet authors

* refactor(hooks): rename action inputs to suffix with _hook

* refactor(hooks): include _hook suffix in event identifier

* docs(hooks): add notes about security implications of hooks

.github/ISSUE_TEMPLATE/config.yml

@@ -5,4 +5,4 @@ contact_links:
     about: If you can't get something to work the way you expect, open a question in our discussion forums.
   - name: Feature Request
     url: https://github.com/stefanzweifel/git-auto-commit-action/discussions/new?category=ideas
-    about: 'Suggest any ideas you have using our discussion forums.'
+    about: "Suggest any ideas you have using our discussion forums."

.github/SECURITY.md

@@ -0,0 +1,3 @@
+# Security Policy
+
+If you discover any security related issues, please email stefan@stefanzweifel.dev instead of using the issue tracker.

.github/workflows/git-auto-commit.yml

@@ -16,7 +16,7 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         ref: ${{ github.head_ref }}
 

.github/workflows/linter.yml

@@ -9,7 +9,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Lint Code Base
         uses: github/super-linter@v7

.github/workflows/release-drafter.yml

@@ -15,6 +15,6 @@ jobs:
       contents: write
 
     steps:
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/tests.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Install testing dependencies
       run: yarn install

.github/workflows/update-changelog.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: master
 

CHANGELOG.md

@@ -5,10 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
-## [Unreleased](https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.0.0...HEAD)
+## [Unreleased](https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.1.0...HEAD)
 
 > TBD
 
+## [v7.1.0](https://github.com/stefanzweifel/git-auto-commit-action/compare/v7.0.0...v7.1.0) - 2025-12-17
+
+### Added
+
+- Add skip_push input option ([#401](https://github.com/stefanzweifel/git-auto-commit-action/pull/401)) [@kvanzuijlen](https://github.com/@kvanzuijlen)
+
+### Changes
+
+- docs: fix typo in README.md ([#400](https://github.com/stefanzweifel/git-auto-commit-action/pull/400)) [@GideonBear](https://github.com/@GideonBear)
+
+### Dependency Updates
+
+- Bump actions/checkout from 5 to 6 ([#399](https://github.com/stefanzweifel/git-auto-commit-action/pull/399)) [@[dependabot[bot]](https://github.com/apps/dependabot)](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
+- Bump bats from 1.12.0 to 1.13.0 ([#398](https://github.com/stefanzweifel/git-auto-commit-action/pull/398)) [@[dependabot[bot]](https://github.com/apps/dependabot)](https://github.com/@[dependabot[bot]](https://github.com/apps/dependabot))
+
 ## [v7.0.0](https://github.com/stefanzweifel/git-auto-commit-action/compare/v6.0.1...v7.0.0) - 2025-10-12
 
 ### Added

CODE_OF_CONDUCT.md

@@ -72,5 +72,4 @@ available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.ht
 
 [homepage]: https://www.contributor-covenant.org
 
-For answers to common questions about this code of conduct, see
+For answers to common questions about this code of conduct, see the [Contributor Covenant FAQ](https://www.contributor-covenant.org/faq).
-https://www.contributor-covenant.org/faq

EXAMPLES.md

@@ -0,0 +1,551 @@
+# Examples
+
+This document shows real-world scenarios where `git-auto-commit` is useful, with a working GitHub Actions workflow for each. The scenarios are based on questions and use cases that have come up in the [issues](https://github.com/stefanzweifel/git-auto-commit-action/issues) and [discussions](https://github.com/stefanzweifel/git-auto-commit-action/discussions) of this repository over the years.
+
+If you have a use case that isn't covered here, [open a discussion](https://github.com/stefanzweifel/git-auto-commit-action/discussions) — we may add it.
+
+## Table of Contents
+
+- [Auto-format code on pull requests](#auto-format-code-on-pull-requests)
+- [Auto-fix lint errors](#auto-fix-lint-errors)
+- [Update dependency lock files](#update-dependency-lock-files)
+- [Build and commit compiled assets](#build-and-commit-compiled-assets)
+- [Auto-generate API documentation](#auto-generate-api-documentation)
+- [Update README with generated content](#update-readme-with-generated-content)
+- [Maintain a CHANGELOG](#maintain-a-changelog)
+- [Sync translations / i18n files](#sync-translations--i18n-files)
+- [Publish a static site to a separate branch](#publish-a-static-site-to-a-separate-branch)
+- [Scheduled data refresh](#scheduled-data-refresh)
+- [Create a release tag without a commit](#create-a-release-tag-without-a-commit)
+- [Fail the build instead of pushing changes (drift check)](#fail-the-build-instead-of-pushing-changes-drift-check)
+- [Sign automated commits with GPG](#sign-automated-commits-with-gpg)
+- [Squash automated changes into the previous commit](#squash-automated-changes-into-the-previous-commit)
+
+---
+
+## Auto-format code on pull requests
+
+**Description:** Run a code formatter (Prettier, php-cs-fixer, Black, gofmt, rustfmt, …) on every pull request and commit the resulting changes back to the contributor's branch. Contributors don't have to think about style; the bot fixes it for them.
+
+This is the most common use case for this Action. Running it on `pull_request` means the formatter only touches the PR branch — never your default branch directly.
+
+```yaml
+name: Format
+
+on: pull_request
+
+jobs:
+  prettier:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npx prettier --write .
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "style: apply prettier formatting"
+```
+
+> [!TIP]
+> If the PR comes from a fork, the Action can only push back if the contributor enabled "Allow edits by maintainers". See the [forks section in the README](README.md#use-in-forks-from-public-repositories) for details.
+
+---
+
+## Auto-fix lint errors
+
+**Description:** Many linters can both report and auto-fix problems (`eslint --fix`, `rubocop -a`, `ruff --fix`, `stylelint --fix`, …). Use the Action to commit the auto-fixed result so reviewers only see the issues that need human judgement.
+
+```yaml
+name: Lint and fix
+
+on: pull_request
+
+jobs:
+  eslint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+      - run: npx eslint . --fix
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "chore: apply eslint --fix"
+```
+
+> [!TIP]
+> `file_pattern` is intentionally omitted here. If one of several custom patterns does not match a file in the repository, `git add` can fail with a pathspec error. Let the linter decide which files to change, or use a custom pattern that you know exists in your repository.
+
+---
+
+## Update dependency lock files
+
+**Description:** When a dependency tool produces a fresh lock file (`package-lock.json`, `composer.lock`, `Gemfile.lock`, `poetry.lock`, …), commit only the lock file. Pair this with a scheduled job to keep lock files in sync without manual intervention.
+
+```yaml
+name: Refresh lock file
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # every Monday at 06:00 UTC
+  workflow_dispatch:
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npm install --package-lock-only
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "chore(deps): refresh package-lock.json"
+          file_pattern: package-lock.json
+```
+
+---
+
+## Build and commit compiled assets
+
+**Description:** For projects that ship a `dist/` folder (libraries, browser extensions, themes), build the assets in CI and commit them so consumers can install directly from the repo without a build step.
+
+```yaml
+name: Build dist
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+      - run: npm run build
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "build: update dist/"
+          file_pattern: "dist/**"
+```
+
+> [!NOTE]
+> If `dist/` is in `.gitignore`, the Action will not pick up changes. See the [troubleshooting section in the README](README.md#change-to-file-is-not-detected).
+
+---
+
+## Auto-generate API documentation
+
+**Description:** Tools like TypeDoc, Doxygen, Sphinx, or `cargo doc` generate documentation from source comments. Regenerate on every push to `main` and commit the output so the published docs always match the latest code.
+
+```yaml
+name: Docs
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  typedoc:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+      - run: npx typedoc --out docs/api src/index.ts
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "docs: regenerate API reference"
+          file_pattern: "docs/api/**"
+```
+
+---
+
+## Update README with generated content
+
+**Description:** Many projects keep dynamic sections in the README — a contributor list, a badge gallery, a table of contents, a list of supported plugins. Regenerate them on a schedule (or when a related file changes) and commit the result.
+
+```yaml
+name: Update contributors
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # weekly
+  workflow_dispatch:
+
+jobs:
+  contributors:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: akhilmhdh/contributors-readme-action@v2.3.10
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "docs: update contributors"
+          file_pattern: README.md
+```
+
+---
+
+## Maintain a CHANGELOG
+
+**Description:** Generate or update `CHANGELOG.md` from commit history or release notes after each merge to `main`, and commit it back.
+
+```yaml
+name: Update CHANGELOG
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # full history so the generator sees all commits
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npx conventional-changelog -p angular -i CHANGELOG.md -s
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "docs: update CHANGELOG"
+          file_pattern: CHANGELOG.md
+```
+
+---
+
+## Sync translations / i18n files
+
+**Description:** When translations are managed in an external service (Crowdin, Lokalise, Weblate) or extracted from source, pull or generate the latest catalogs on a schedule and commit them.
+
+```yaml
+name: Sync translations
+
+on:
+  schedule:
+    - cron: "0 3 * * *" # daily at 03:00 UTC
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Download translations
+        run: ./scripts/pull-translations.sh
+        env:
+          CROWDIN_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "i18n: sync translations from Crowdin"
+          file_pattern: "locales/**/*.json"
+```
+
+---
+
+## Publish a static site to a separate branch
+
+**Description:** Build a static site on `main` and push the generated output to a `gh-pages` branch so GitHub Pages can serve it. Use a second checkout directory for the publish branch so the source checkout and generated site do not get mixed together.
+
+Create the `gh-pages` branch once before using this workflow.
+
+```yaml
+name: Build site
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: source
+
+      - uses: actions/checkout@v5
+        with:
+          ref: gh-pages
+          path: site
+
+      - name: Build site
+        working-directory: source
+        run: ./build-site.sh # produces output in ./public
+
+      - name: Replace publish branch contents
+        run: |
+          find site -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} +
+          cp -R source/public/. site/
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          repository: site
+          branch: gh-pages
+          commit_message: "site: rebuild from ${{ github.sha }}"
+```
+
+> [!NOTE]
+> For most Pages workflows the official [`actions/deploy-pages`](https://github.com/actions/deploy-pages) is a better fit. Use this approach when you specifically want the build output stored in a branch.
+
+---
+
+## Scheduled data refresh
+
+**Description:** Pull data from an external source on a schedule and commit it. Common examples: tracking statistics, snapshotting an API response, refreshing a cached dataset.
+
+```yaml
+name: Refresh stats
+
+on:
+  schedule:
+    - cron: "0 * * * *" # hourly
+  workflow_dispatch:
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - run: curl -sSL https://api.example.com/stats.json -o data/stats.json
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "data: refresh hourly stats"
+          file_pattern: "data/*.json"
+```
+
+---
+
+## Create a release tag without a commit
+
+**Description:** Sometimes you want to tag the current HEAD as a release without committing any files. Use `create_git_tag_only` together with `tag_name` and `tagging_message`.
+
+```yaml
+name: Tag release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to tag (e.g. v1.4.0)"
+        required: true
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          create_git_tag_only: true
+          tag_name: ${{ inputs.version }}
+          tagging_message: "Release ${{ inputs.version }}"
+```
+
+---
+
+## Fail the build instead of pushing changes (drift check)
+
+**Description:** Sometimes you don't want a bot to push fixes — you want to fail the build so the contributor fixes them locally. Use the `changes_detected` output as a check: run the formatter, skip branch checkout/fetch/push, and fail if anything changed.
+
+```yaml
+name: Format check
+
+on: pull_request
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npx prettier --write .
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        id: auto-commit
+        with:
+          skip_checkout: true
+          skip_fetch: true
+          skip_push: true
+
+      - name: Fail if formatting was needed
+        if: steps.auto-commit.outputs.changes_detected == 'true'
+        run: |
+          echo "::error::Code is not formatted. Run 'npx prettier --write .' locally."
+          exit 1
+```
+
+---
+
+## Sign automated commits with GPG
+
+**Description:** If your branch protection rules require signed commits, the bot's commits need to be signed too. Import a GPG key first, then tell the Action to use the key's identity as the commit author.
+
+```yaml
+name: Format (signed)
+
+on: pull_request
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+
+      - name: Import GPG key
+        id: import-gpg
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+
+      - run: npx prettier --write .
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "style: apply prettier"
+          commit_user_name: ${{ steps.import-gpg.outputs.name }}
+          commit_user_email: ${{ steps.import-gpg.outputs.email }}
+          commit_author: "${{ steps.import-gpg.outputs.name }} <${{ steps.import-gpg.outputs.email }}>"
+```
+
+See discussion [#334](https://github.com/stefanzweifel/git-auto-commit-action/discussions/334) for background.
+
+---
+
+## Squash automated changes into the previous commit
+
+**Description:** Avoid noisy "apply automatic changes" commits by amending the last commit instead. Useful when the bot fix is trivial and you don't want a separate entry in the history.
+
+> [!CAUTION]
+> Amending rewrites history. Only use this on branches where force-pushing is acceptable (typically PR branches, never `main`).
+
+```yaml
+name: Format (amend)
+
+on: pull_request
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 2 # need previous commit for --amend
+
+      - run: npx prettier --write .
+
+      - name: Read previous commit metadata
+        id: last
+        run: |
+          echo "message=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
+          echo "author=$(git log -1 --pretty='%an <%ae>')" >> $GITHUB_OUTPUT
+
+      - uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: ${{ steps.last.outputs.message }}
+          commit_author: ${{ steps.last.outputs.author }}
+          commit_options: "--amend --no-edit"
+          push_options: "--force"
+          skip_fetch: true
+```
+
+See discussion [#159](https://github.com/stefanzweifel/git-auto-commit-action/issues/159#issuecomment-845347950) for details.

README.md

@@ -11,11 +11,16 @@ By default, the commit is made in the name of "GitHub Actions" and co-authored b
 
 If you want to learn more how this Action works under the hood, check out [this article](https://michaelheap.com/git-auto-commit/) by Michael Heap.
 
+If your use case is not covered by git-auto-commit, you might want to check out the following alternative Actions:
+
+- [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action)
+- [EndBug/add-and-commit](https://github.com/EndBug/add-and-commit)
+
 ## Usage
 
 Adding git-auto-commit to your Workflow only takes a couple lines of code.
 
-1. Set the `contents`-permission of the default GITHUB_TOKEN to `true`. (Required to push new commits to the repository)
+1. Set the `contents`-permission of the default GITHUB_TOKEN to `write`. (Required to push new commits to the repository)
 2. Add the following step at the end of your job, after other steps that might add or change files.
 
 ```yaml
@@ -42,6 +47,8 @@ jobs:
       - uses: actions/checkout@v5
         with:
           ref: ${{ github.head_ref }}
+          # Value already defaults to true, but `persist-credentials` is required to push new commits to the repository.
+          persist-credentials: true
 
       # Other steps that change files in the repository go here
       # …
@@ -77,7 +84,7 @@ The following is an extended example with all available options.
     # - https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefpathspecapathspec
     file_pattern: '*.php src/*.js tests/*.js'
 
-    # Optional. Local file path to the repository.
+    # Optional. Relative file path under $GITHUB_WORKSPACE to the repository.
     # Defaults to the root of the repository.
     repository: .
 
@@ -129,6 +136,24 @@ The following is an extended example with all available options.
     # Optional. Creates a new tag and pushes it to remote without creating a commit.
     # Skips dirty check and changed files. Must be used in combination with `tag` and `tagging_message`.
     create_git_tag_only: false
+
+    # Optional. Suppress the security warning emitted when the action runs on a
+    # `pull_request_target` event. See the "Workflow should run in **base** repository"
+    # section below for context before disabling this warning.
+    disable_pull_request_target_trigger_warning: false
+
+    # Optional. Shell snippets to run around each git operation. Each hook
+    # is evaluated in the same bash process as the action — `set -eu` is
+    # in effect, the working directory is your repository, and all
+    # `INPUT_*` env vars are visible. A non-zero exit aborts the action.
+    before_add_hook: ''
+    after_add_hook: ''
+    before_commit_hook: ''
+    after_commit_hook: ''
+    before_tag_hook: ''
+    after_tag_hook: ''
+    before_push_hook: ''
+    after_push_hook: ''
 ```
 
 Please note that the Action depends on `bash`. If you're using the Action in a job in combination with a custom Docker container, make sure that `bash` is installed.
@@ -170,6 +195,8 @@ jobs:
         commit_message: Apply php-cs-fixer changes
 ```
 
+See [EXAMPLES.md](EXAMPLES.md) for more scenarios, including auto-formatting, dependency updates, generated docs, release tagging, drift checks, and GPG-signed commits.
+
 ## Inputs
 
 Checkout [`action.yml`](https://github.com/stefanzweifel/git-auto-commit-action/blob/master/action.yml) for a full list of supported inputs.
@@ -201,6 +228,87 @@ You can use these outputs to trigger other Actions in your Workflow run based on
     run: echo "No Changes!"
 ```
 
+## Hooks
+
+git-auto-commit can run custom shell snippets around each git operation
+it performs. This is useful when you need to prepare or clean up the
+repository as part of the same step — for example, unshallowing a
+shallow clone right before the commit is staged.
+
+Eight optional hooks are available:
+
+| Hook | Runs |
+| ---- | ---- |
+| `before_add_hook` / `after_add_hook` | around `git add` |
+| `before_commit_hook` / `after_commit_hook` | around `git commit` |
+| `before_tag_hook` / `after_tag_hook` | around `git tag` (only when a tag is being created) |
+| `before_push_hook` / `after_push_hook` | around `git push` (skipped when `skip_push: true`) |
+
+Each hook is an inline shell snippet that runs in the same bash process
+as the action. The working directory is your repository, and all
+`INPUT_*` environment variables and standard GitHub Actions env vars are
+visible to the snippet.
+
+### Example
+
+```yaml
+- uses: stefanzweifel/git-auto-commit-action@v7
+  with:
+    before_add_hook: |
+      git fetch --unshallow
+```
+
+Multi-line snippets work via YAML's `|` block scalar:
+
+```yaml
+- uses: stefanzweifel/git-auto-commit-action@v7
+  with:
+    before_commit_hook: |
+      echo "About to commit at $(date)"
+      ./scripts/prepare-commit.sh
+```
+
+### Notes
+
+- A hook only runs when its underlying step actually runs. For example,
+  `before_add_hook`/`after_add_hook` are skipped when the working tree is clean,
+  and `before_push_hook`/`after_push_hook` are skipped when `skip_push: true`.
+- If a hook exits with a non-zero status, the action fails. Append
+  `|| true` to a snippet to ignore its failure.
+- Hooks share environment with the action, so they can read action
+  inputs (e.g. `$INPUT_COMMIT_MESSAGE`) and write to `$GITHUB_OUTPUT`.
+- Snippets run under `set -eu`. Referencing an unset variable aborts the
+  action; use `${VAR:-}` to default an optional variable to empty.
+
+### Security
+
+Hook snippets are evaluated as shell code in the same process as the
+action. Treat them as you would any `run:` step.
+
+> [!CAUTION]
+> **Do not combine hooks with the `pull_request_target` event when the
+> snippet references attacker-controlled GitHub context.** Fields like
+> `${{ github.event.pull_request.title }}`, `${{ github.event.pull_request.body }}`,
+> `${{ github.head_ref }}`, and commit messages from a fork are
+> interpolated into the snippet **before** bash sees it. A malicious PR
+> can inject shell commands that run on your runner with access to your
+> repository secrets. See the [`pull_request_target` section](#workflow-should-run-in-base-repository)
+> for the broader risk and [GitHub's script-injection guidance](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections).
+
+If you need values from PR-controlled context inside a hook, pass them
+via an intermediate env var rather than interpolating them directly into
+the snippet:
+
+```yaml
+- uses: stefanzweifel/git-auto-commit-action@v7
+  env:
+    PR_TITLE: ${{ github.event.pull_request.title }}
+  with:
+    before_commit_hook: |
+      # $PR_TITLE is read as data, not evaluated as code
+      echo "PR: $PR_TITLE"
+```
+
 ## Limitations & Gotchas
 
 The goal of this Action is to be "the Action for committing files for the 80% use case". Therefore, you might run into issues if your Workflow falls into the not supported 20% portion.
@@ -249,13 +357,13 @@ storing the token as a secret in your repository and then passing the new token
 If you create a personal access token (classic), apply the `repo` and `workflow` scopes.
 If you create a fine-grained personal access token, apply the `Contents`-permissions.
 
-If you work in an organization and don't want to create a PAT from your personal account, we recommend using a [robot account](https://docs.github.com/en/github/getting-started-with-github/types-of-github-accounts) for the token.
+If you work in an organization and don't want to create a PAT from your personal account, we recommend using a [robot account](https://docs.github.com/en/get-started/learning-about-github/types-of-github-accounts) for the token.
 
 ### Prevent Infinite Loop when using a Personal Access Token
 
 If you're using a Personal Access Token (PAT) to push commits to GitHub repository, the resulting commit or push can trigger other GitHub Actions workflows. This can result in an infinite loop.
 
-If you would like to prevent this, you can add `skip-checks:true` to the commit message. See [Skipping workflow runs](https://docs.github.com/en/actions/managing-workflow-runs/skipping-workflow-runs) for details.
+If you would like to prevent this, you can add `skip-checks:true` to the commit message. See [Skipping workflow runs](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs) for details.
 
 ### Change to file is not detected
 
@@ -267,7 +375,7 @@ Does your workflow change a file, but "git-auto-commit" does not detect the chan
 
 If your commit message should span multiple lines, you have to create a separate step to generate the string.
 
-The example below can be used as a starting point to generate a multiline commit meesage. Learn more how multiline strings in GitHub Actions work in the [GitHub documentation](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings).
+The example below can be used as a starting point to generate a multiline commit meesage. Learn more how multiline strings in GitHub Actions work in the [GitHub documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#multiline-strings).
 
 ```yaml
     # Building a multiline commit message
@@ -322,15 +430,16 @@ See discussion [#334](https://github.com/stefanzweifel/git-auto-commit-action/di
 
 ### Use in forks from private repositories
 
+
 By default, GitHub Actions doesn't run Workflows on forks from **private** repositories. To enable Actions for **private** repositories enable "Run workflows from pull requests" in your repository settings.
 
-See [this announcement from GitHub](https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/) or the [GitHub docs](https://docs.github.com/en/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks) for details.
+See [this announcement from GitHub](https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/) or the [GitHub docs](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks) for details.
 
 
 ### Use in forks from public repositories
 
 > [!NOTE] 
-> This Action technically works with forks. However, please note that the combination of triggers and their options can cause issues. Please read [the documentation](https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows) on which triggers GitHub Actions support.\
+> This Action technically works with forks. However, please note that the combination of triggers and their options can cause issues. Please read [the documentation](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows) on which triggers GitHub Actions support.\
 > Ensure your contributors enable "Allow edits by maintainers" when opening a pull request. ([Learn more](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)) \
 > \
 > **If you use this Action in combination with a linter/fixer, it's easier if you run the Action on `push` on your `main`-branch.**
@@ -339,17 +448,22 @@ See [this announcement from GitHub](https://github.blog/2020-08-03-github-action
 > Due to limitations of GitHub, this Action currently can't push commits to a base repository, if the fork _lives_ under an organisation. See [github/community#6634](https://github.com/orgs/community/discussions/5634) and [this comment](https://github.com/stefanzweifel/git-auto-commit-action/issues/211#issuecomment-1428849944) for details.
 
 By default, this Action will not run on Pull Requests which have been opened by forks. (This is a limitation by GitHub, not by us.)
-However, there are a couple of ways to use this Actions in Workflows that should be triggered by forked repositories.
+However, there are a couple of ways to use this Action in Workflows that should be triggered by forked repositories.
 
 ### Workflow should run in **base** repository
 
 > [!CAUTION]
 > The following section explains how you can use git-auto-commit in combination with the `pull_request_target` trigger.
 > **Using `pull_request_target` in your workflows can lead to repository compromise as [mentioned](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) by GitHub's own security team. This means, that a bad actor could potentially leak/steal your GitHub Actions repository secrets.**
-> Please be aware of this risk when using `pull_request_target` in your workflows.
+> Please be aware of this risk when using `pull_request_target` in your workflows. See [GitHub's documentation](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target) for more information.
 >
 > If your workflow runs code-fixing tools, consider running the workflow on your default branch by listening to the `push` event or use a third-party tool like [autofix.ci](https://autofix.ci/).
 > We keep this documentation around, as many questions came in over the years, on how to use this action for public forks.
+>
+> To remind users of this risk, git-auto-commit emits a warning annotation whenever it detects it is running on a `pull_request_target` event.
+> If you have evaluated the risk and want to silence the warning, set the `disable_pull_request_target_trigger_warning` input to `true`.
+>
+> **Extra caution if you also use [hooks](#hooks):** hook snippets are evaluated as shell code. Interpolating attacker-controlled fields (PR title/body, branch name, fork commit messages, etc.) directly into a hook input on a `pull_request_target` workflow lets a malicious PR run arbitrary commands on your runner with access to your secrets. Pass such values through an `env:` block and reference them as `$VARS` inside the snippet — see the [Security note in the Hooks section](#security) for an example.
 
 The workflow below runs whenever a commit is pushed to the `main`-branch or when activity on a pull request happens, by listening to the [`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) event.
 
@@ -410,7 +524,7 @@ Finally, you have to use `push_options: '--force'` to overwrite the git history
 The steps in your workflow might look like this:
 
 ```yaml
-- uses: actions/checkout@4
+- uses: actions/checkout@v4
   with:
     # Fetch the last 2 commits instead of just 1. (Fetching just 1 commit would overwrite the whole history)
     fetch-depth: 2
@@ -435,6 +549,7 @@ The steps in your workflow might look like this:
 See discussion in [#159](https://github.com/stefanzweifel/git-auto-commit-action/issues/159#issuecomment-845347950) for details.
 
 ## Troubleshooting
+
 ### Action does not push commit to repository
 
 Make sure to [checkout the correct branch](#checkout-the-correct-branch).
@@ -444,14 +559,16 @@ Make sure to [checkout the correct branch](#checkout-the-correct-branch).
 If your Workflow can't push the commit to the repository because of authentication issues,
 please update your Workflow configuration and usage of [`actions/checkout`](https://github.com/actions/checkout#usage).
 
-Updating the `token` value with a Personal Access Token should fix your issues.
+Please note that `persist-credentials` in `actions/checkout` must be set to `true` to push new commits to the repository.
+
+If you still can't push the commit, and you're using branch protection rules or similar features, updating the `token` value with a Personal Access Token should fix your issues.
 
 ### git-auto-commit fails to push commit that creates or updates files in `.github/workflows/`
 
 The default `GITHUB_TOKEN` issued by GitHub Action does not have permission to make changes to workflow files located in `.github/workflows/`.
 To fix this, please create a personal access token (PAT) and pass the token to the `actions/checkout`-step in your workflow. (Similar to [how to push to protected branches](https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#push-to-protected-branches)).
 
-If a PAT does not work for you, you could also create a new GitHub app and use it's token in your workflows. See [this comment in #87](https://github.com/stefanzweifel/git-auto-commit-action/issues/87#issuecomment-1939138661) for details.
+If a PAT does not work for you, you could also create a new GitHub app and use its token in your workflows. See [this comment in #87](https://github.com/stefanzweifel/git-auto-commit-action/issues/87#issuecomment-1939138661) for details.
 
 See [#322](https://github.com/stefanzweifel/git-auto-commit-action/issues/322) for details and discussions around this topic.
 
@@ -471,13 +588,13 @@ If you create a fine-grained personal access token, apply the `Contents`-permiss
     # We pass the "PAT" secret to the checkout action; if no PAT secret is available to the workflow runner (eg. Dependabot) we fall back to the default "GITHUB_TOKEN".
     token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
 ```
-You can learn more about Personal Access Token in the [GitHub documentation](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token).
+You can learn more about Personal Access Token in the [GitHub documentation](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens).
 
 
 > [!TIP]
 > If you're working in an organisation, and you don't want to create the PAT from your personal account, we recommend using a bot-account for such tokens.
 
-If you go the "force pushes" route, you have to enable force pushes to a protected branch (see [documentation](https://help.github.com/en/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)) and update your Workflow to use force push like this.
+If you go the "force pushes" route, you have to enable force pushes to a protected branch (see [documentation](https://docs.github.com/en/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)) and update your Workflow to use force push like this.
 
 ```yaml
     - uses: stefanzweifel/git-auto-commit-action@v7
@@ -500,7 +617,7 @@ See [Issue #227](https://github.com/stefanzweifel/git-auto-commit-action/issues/
 
 ### Custom `file_pattern`, changed files but seeing "Working tree clean. Nothing to commit." in the logs
 
-If you're using a custom `file_pattern` and the Action does not detect the changes made in your worfklow, you're probably running into a globbing issue.
+If you're using a custom `file_pattern` and the Action does not detect the changes made in your workflow, you're probably running into a globbing issue.
 
 Let's imagine you use `file_pattern: '*.md'` to detect and commit changes to all Markdown files in your repository.
 If your Workflow now only updates `.md`-files in a subdirectory, but you have an untouched `.md`-file in the root of the repository, the git-auto-commit Action will display "Working tree clean. Nothing to commit." in the Workflow log.
@@ -536,10 +653,10 @@ yarn test
 
 ## Versioning
 
-We use [SemVer](http://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/stefanzweifel/git-auto-commit-action/tags).
+We use [SemVer](https://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/stefanzweifel/git-auto-commit-action/tags).
 
 We also provide major version tags to make it easier to always use the latest release of a major version. For example, you can use `stefanzweifel/git-auto-commit-action@v7` to always use the latest release of the current major version.
-(More information about this [here](https://help.github.com/en/actions/building-actions/about-actions#versioning-your-action).)
+(More information about this [here](https://docs.github.com/en/actions/building-actions/about-actions#versioning-your-action).)
 
 ## Credits
 

UPGRADING.md

@@ -4,7 +4,8 @@
 
 The previously removed options `create_branch`, `skip_fetch`, and `skip_checkout` have been reintroduced in git-auto-commit v7. If you had removed these options from your workflows when upgrading to v6, you can now add them back if needed.
 
-Tagging a commit has been reworked. In addition to the existing `tagging_message`-option, a new `tag_name` option has been added. If you were using `tagging_message`, you can continue to do so, but if you want to specify a custom tag name and tag message, you can now use the `tag_name` and `tagging_message` option.
+Tagging a commit has been reworked. In addition to the existing `tagging_message`-option, a new `tag_name` option has been added. If you were using `tagging_message`, you can continue to do so, but if you want to specify a custom tag name and tag message, you can now use the `tag_name` and `tagging_message` options.
+
 (Specifying a `tagging_message` without a `tag_name` will create a tag with the name and message both set to the value of `tagging_message`.)
 
 ## From v5 to v6

action.yml

@@ -25,11 +25,11 @@ inputs:
     required: false
     default: ''
   file_pattern:
-    description: File pattern used for `git add`. For example `src/*.js`
+    description: File pattern used for `git add` and the dirty-check (`git status`). Supports multiple space-separated patterns. For example `src/*.js`
     required: false
     default: '.'
   repository:
-    description: Local file path to the git repository. Defaults to the current directory (`.`)
+    description: Relative file path under $GITHUB_WORKSPACE to the git repository. Defaults to the current directory (`.`)
     required: false
     default: '.'
   commit_user_name:
@@ -74,26 +74,65 @@ inputs:
     default: false
   disable_globbing:
     description: Stop the shell from expanding filenames (https://www.gnu.org/software/bash/manual/html_node/Filename-Expansion.html)
+    required: false
     default: false
   create_branch:
     description: Create new branch with the name of `branch`-input in local and remote repository, if it doesn't exist yet.
+    required: false
     default: false
   create_git_tag_only:
     description: Perform a clean git tag and push, without commiting anything
     required: false
     default: false
+  before_add_hook:
+    description: Shell snippet to run before `git add`.
+    required: false
+    default: ''
+  after_add_hook:
+    description: Shell snippet to run after `git add`.
+    required: false
+    default: ''
+  before_commit_hook:
+    description: Shell snippet to run before `git commit`.
+    required: false
+    default: ''
+  after_commit_hook:
+    description: Shell snippet to run after `git commit`.
+    required: false
+    default: ''
+  before_tag_hook:
+    description: Shell snippet to run before `git tag` is created.
+    required: false
+    default: ''
+  after_tag_hook:
+    description: Shell snippet to run after `git tag` is created.
+    required: false
+    default: ''
+  before_push_hook:
+    description: Shell snippet to run before `git push`.
+    required: false
+    default: ''
+  after_push_hook:
+    description: Shell snippet to run after `git push`.
+    required: false
+    default: ''
+  disable_pull_request_target_trigger_warning:
+    description: Suppress the security warning emitted when the action runs on a `pull_request_target` event.
+    required: false
+    default: false
   internal_git_binary:
     description: Internal use only! Path to git binary used to check if git is available. (Don't change this!)
+    required: false
     default: git
 
 
 outputs:
   changes_detected:
-    description: Value is "true", if the repository was dirty and file changes have been detected. Value is "false", if no changes have been detected.
+    description: Value is "true" if matching changes were detected and committed. Value is "false" if no matching changes were detected or only CRLF changes were staged. Not set in `create_git_tag_only` mode.
   commit_hash:
-    description: Full hash of the created commit. Only present if the "changes_detected" output is "true".
+    description: Full hash of the created commit. Only set when a commit was actually made (i.e. `changes_detected` is "true").
   create_git_tag_only:
-    description: Value is "true", if a git tag was created using the `create_git_tag_only`-input.
+    description: Set to "true" when the action ran in `create_git_tag_only` mode. Never set to "false".
 
 runs:
   using: 'node24'

entrypoint.sh

@@ -26,6 +26,16 @@ _log() {
     echo "::$level::$message";
 }
 
+_run_hook() {
+    local name=${1}
+    local snippet=${2:-}
+
+    if [ -n "$snippet" ]; then
+        _log "debug" "Running $name";
+        eval "$snippet"
+    fi
+}
+
 _main() {
     _check_if_git_is_available
 
@@ -35,29 +45,61 @@ _main() {
 
     _check_if_repository_is_in_detached_state
 
+    _check_for_pull_request_target_trigger
+
     if "$INPUT_CREATE_GIT_TAG_ONLY"; then
         _log "debug" "Create git tag only";
         _set_github_output "create_git_tag_only" "true"
+
+        if [ -n "$INPUT_TAG_NAME" ] || [ -n "$INPUT_TAGGING_MESSAGE" ]; then
+            _run_hook "before_tag_hook" "$INPUT_BEFORE_TAG_HOOK"
             _tag_commit
+            _run_hook "after_tag_hook" "$INPUT_AFTER_TAG_HOOK"
+        else
+            _tag_commit
+        fi
+
+        if ! "$INPUT_SKIP_PUSH"; then
+            _run_hook "before_push_hook" "$INPUT_BEFORE_PUSH_HOOK"
+        fi
         _push_to_github
+        if ! "$INPUT_SKIP_PUSH"; then
+            _run_hook "after_push_hook" "$INPUT_AFTER_PUSH_HOOK"
+        fi
     elif _git_is_dirty || "$INPUT_SKIP_DIRTY_CHECK"; then
 
         _set_github_output "changes_detected" "true"
 
         _switch_to_branch
 
+        _run_hook "before_add_hook" "$INPUT_BEFORE_ADD_HOOK"
         _add_files
+        _run_hook "after_add_hook" "$INPUT_AFTER_ADD_HOOK"
 
         # Check dirty state of repo again using git-diff.
         # (git-diff detects better if CRLF of files changes and does NOT
         # proceed, if only CRLF changes are detected. See #241 and #265
         # for more details.)
         if [ -n "$(git diff --staged)" ] || "$INPUT_SKIP_DIRTY_CHECK"; then
+            _run_hook "before_commit_hook" "$INPUT_BEFORE_COMMIT_HOOK"
             _local_commit
+            _run_hook "after_commit_hook" "$INPUT_AFTER_COMMIT_HOOK"
 
+            if [ -n "$INPUT_TAG_NAME" ] || [ -n "$INPUT_TAGGING_MESSAGE" ]; then
+                _run_hook "before_tag_hook" "$INPUT_BEFORE_TAG_HOOK"
                 _tag_commit
+                _run_hook "after_tag_hook" "$INPUT_AFTER_TAG_HOOK"
+            else
+                _tag_commit
+            fi
 
+            if ! "$INPUT_SKIP_PUSH"; then
+                _run_hook "before_push_hook" "$INPUT_BEFORE_PUSH_HOOK"
+            fi
             _push_to_github
+            if ! "$INPUT_SKIP_PUSH"; then
+                _run_hook "after_push_hook" "$INPUT_AFTER_PUSH_HOOK"
+            fi
         else
             _set_github_output "changes_detected" "false"
 
@@ -107,6 +149,16 @@ _check_if_is_git_repository() {
     fi
 }
 
+_check_for_pull_request_target_trigger() {
+    if "$INPUT_DISABLE_PULL_REQUEST_TARGET_TRIGGER_WARNING"; then
+        return
+    fi
+
+    if [ "${GITHUB_EVENT_NAME:-}" = "pull_request_target" ]; then
+        _log "warning" "git-auto-commit is running on a 'pull_request_target' event. This trigger can be a security risk: a malicious pull request could potentially exfiltrate your repository secrets. See https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target and the 'pull_request_target' section in the git-auto-commit README (https://github.com/stefanzweifel/git-auto-commit-action#using-the-action-in-a-pull_request_target-workflow) for safer usage. Set 'disable_pull_request_target_trigger_warning: true' to suppress this warning.";
+    fi
+}
+
 _check_if_repository_is_in_detached_state() {
     if [ -z "$(git symbolic-ref HEAD)" ]
     then

tests/git-auto-commit.bats

@@ -41,7 +41,20 @@ setup() {
     export INPUT_SKIP_PUSH=false
     export INPUT_DISABLE_GLOBBING=false
     export INPUT_CREATE_BRANCH=false
+    export INPUT_DISABLE_PULL_REQUEST_TARGET_TRIGGER_WARNING=false
     export INPUT_INTERNAL_GIT_BINARY=git
+    export INPUT_BEFORE_ADD_HOOK=""
+    export INPUT_AFTER_ADD_HOOK=""
+    export INPUT_BEFORE_COMMIT_HOOK=""
+    export INPUT_AFTER_COMMIT_HOOK=""
+    export INPUT_BEFORE_TAG_HOOK=""
+    export INPUT_AFTER_TAG_HOOK=""
+    export INPUT_BEFORE_PUSH_HOOK=""
+    export INPUT_AFTER_PUSH_HOOK=""
+
+    # Unset the GitHub event name by default so tests do not pick up
+    # pull_request_target from the environment of the shell running BATS.
+    unset GITHUB_EVENT_NAME
 
     # Set GitHub environment variables used by the GitHub Action
     temp_github_output_file=$(mktemp -t github_output_test.XXXXX)
@@ -1521,3 +1534,231 @@ END
 
     assert_equal $current_sha $remote_sha
 }
+
+@test "It emits a warning when running on a pull_request_target event" {
+    export GITHUB_EVENT_NAME="pull_request_target"
+
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+
+    run git_auto_commit
+
+    assert_success
+    assert_output --partial "::warning::git-auto-commit is running on a 'pull_request_target' event."
+    assert_output --partial "disable_pull_request_target_trigger_warning"
+}
+
+@test "It does not emit the pull_request_target warning when the event is pull_request" {
+    export GITHUB_EVENT_NAME="pull_request"
+
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+
+    run git_auto_commit
+
+    assert_success
+    refute_output --partial "::warning::git-auto-commit is running on a 'pull_request_target' event."
+}
+
+@test "It does not emit the pull_request_target warning when GITHUB_EVENT_NAME is unset" {
+    unset GITHUB_EVENT_NAME
+
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+
+    run git_auto_commit
+
+    assert_success
+    refute_output --partial "::warning::git-auto-commit is running on a 'pull_request_target' event."
+}
+
+@test "It does not emit the pull_request_target warning when disable_pull_request_target_trigger_warning is true" {
+    export GITHUB_EVENT_NAME="pull_request_target"
+    export INPUT_DISABLE_PULL_REQUEST_TARGET_TRIGGER_WARNING=true
+
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+
+    run git_auto_commit
+
+    assert_success
+    refute_output --partial "::warning::git-auto-commit is running on a 'pull_request_target' event."
+}
+
+@test "It does not log a hook line when no hooks are set" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+
+    run git_auto_commit
+
+    assert_success
+    refute_output --partial "::debug::Running"
+}
+
+@test "It runs the before_add hook before git add" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_ADD_HOOK="echo BEFORE_ADD_RAN > '${FAKE_LOCAL_REPOSITORY}/before-add-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running before_add_hook"
+    [ -f "${FAKE_LOCAL_REPOSITORY}/before-add-marker.txt" ]
+}
+
+@test "It runs the after_add hook after git add" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_AFTER_ADD_HOOK="echo AFTER_ADD_RAN > '${FAKE_LOCAL_REPOSITORY}/after-add-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running after_add_hook"
+    [ -f "${FAKE_LOCAL_REPOSITORY}/after-add-marker.txt" ]
+}
+
+@test "It runs the before_commit hook before creating the commit" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_COMMIT_HOOK="echo BEFORE_COMMIT_RAN > '${FAKE_LOCAL_REPOSITORY}/before-commit-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running before_commit_hook"
+    [ -f "${FAKE_LOCAL_REPOSITORY}/before-commit-marker.txt" ]
+
+    # The marker was created after `git add` ran, so it is NOT in the commit.
+    run git show --name-only HEAD
+    refute_output --partial "before-commit-marker.txt"
+}
+
+@test "It runs the after_commit hook after creating the commit" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_AFTER_COMMIT_HOOK="git rev-parse HEAD > '${FAKE_LOCAL_REPOSITORY}/after-commit-sha.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running after_commit_hook"
+    [ -f "${FAKE_LOCAL_REPOSITORY}/after-commit-sha.txt" ]
+
+    # Sanity check: the SHA written is a valid commit hash
+    run cat "${FAKE_LOCAL_REPOSITORY}/after-commit-sha.txt"
+    assert_output --regexp '^[0-9a-f]{40}$'
+}
+
+@test "It does not run add or commit hooks when the working tree is clean" {
+    export INPUT_BEFORE_ADD_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/before-add-marker.txt'"
+    export INPUT_AFTER_ADD_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/after-add-marker.txt'"
+    export INPUT_BEFORE_COMMIT_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/before-commit-marker.txt'"
+    export INPUT_AFTER_COMMIT_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/after-commit-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "Working tree clean. Nothing to commit."
+    refute_output --partial "::debug::Running"
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/before-add-marker.txt" ]
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/after-add-marker.txt" ]
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/before-commit-marker.txt" ]
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/after-commit-marker.txt" ]
+}
+
+@test "It runs before_tag and after_tag hooks when creating a tag" {
+    INPUT_TAG_NAME="v1.0.0"
+    INPUT_TAGGING_MESSAGE="Release v1.0.0"
+
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_TAG_HOOK="echo BEFORE_TAG_RAN > '${FAKE_LOCAL_REPOSITORY}/before-tag-marker.txt'"
+    export INPUT_AFTER_TAG_HOOK="echo AFTER_TAG_RAN > '${FAKE_LOCAL_REPOSITORY}/after-tag-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running before_tag_hook"
+    assert_line "::debug::Running after_tag_hook"
+    [ -f "${FAKE_LOCAL_REPOSITORY}/before-tag-marker.txt" ]
+    [ -f "${FAKE_LOCAL_REPOSITORY}/after-tag-marker.txt" ]
+}
+
+@test "It does not run tag hooks when no tag name or tagging message is set" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_TAG_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/before-tag-marker.txt'"
+    export INPUT_AFTER_TAG_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/after-tag-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    refute_line "::debug::Running before_tag_hook"
+    refute_line "::debug::Running after_tag_hook"
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/before-tag-marker.txt" ]
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/after-tag-marker.txt" ]
+}
+
+@test "It runs tag hooks under create_git_tag_only mode" {
+    INPUT_CREATE_GIT_TAG_ONLY=true
+    INPUT_TAG_NAME="v1.0.0"
+    INPUT_TAGGING_MESSAGE="Release v1.0.0"
+
+    export INPUT_BEFORE_TAG_HOOK="echo BEFORE_TAG_RAN > '${FAKE_LOCAL_REPOSITORY}/before-tag-marker.txt'"
+    export INPUT_AFTER_TAG_HOOK="echo AFTER_TAG_RAN > '${FAKE_LOCAL_REPOSITORY}/after-tag-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running before_tag_hook"
+    assert_line "::debug::Running after_tag_hook"
+    [ -f "${FAKE_LOCAL_REPOSITORY}/before-tag-marker.txt" ]
+    [ -f "${FAKE_LOCAL_REPOSITORY}/after-tag-marker.txt" ]
+}
+
+@test "It runs before_push and after_push hooks around git push" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_PUSH_HOOK="echo BEFORE_PUSH_RAN > '${FAKE_LOCAL_REPOSITORY}/before-push-marker.txt'"
+    export INPUT_AFTER_PUSH_HOOK="echo AFTER_PUSH_RAN > '${FAKE_LOCAL_REPOSITORY}/after-push-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running before_push_hook"
+    assert_line "::debug::Running after_push_hook"
+    [ -f "${FAKE_LOCAL_REPOSITORY}/before-push-marker.txt" ]
+    [ -f "${FAKE_LOCAL_REPOSITORY}/after-push-marker.txt" ]
+}
+
+@test "It does not run push hooks when skip_push is true" {
+    INPUT_SKIP_PUSH=true
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_PUSH_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/before-push-marker.txt'"
+    export INPUT_AFTER_PUSH_HOOK="echo SHOULD_NOT_RUN > '${FAKE_LOCAL_REPOSITORY}/after-push-marker.txt'"
+
+    run git_auto_commit
+
+    assert_success
+    refute_line "::debug::Running before_push_hook"
+    refute_line "::debug::Running after_push_hook"
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/before-push-marker.txt" ]
+    [ ! -f "${FAKE_LOCAL_REPOSITORY}/after-push-marker.txt" ]
+}
+
+@test "A hook that exits non-zero aborts the action" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_COMMIT_HOOK="exit 1"
+
+    run git_auto_commit
+
+    assert_failure
+    assert_line "::debug::Running before_commit_hook"
+
+    # Assert the action aborted before committing: no commit_hash output was written.
+    run cat_github_output
+    refute_line -e "commit_hash=[0-9a-f]{40}$"
+}
+
+@test "A before_commit hook can mutate INPUT_COMMIT_MESSAGE and the change is reflected in the commit" {
+    touch "${FAKE_LOCAL_REPOSITORY}"/new-file-1.txt
+    export INPUT_BEFORE_COMMIT_HOOK="INPUT_COMMIT_MESSAGE='message rewritten by hook'"
+
+    run git_auto_commit
+
+    assert_success
+    assert_line "::debug::Running before_commit_hook"
+
+    run git -C "${FAKE_LOCAL_REPOSITORY}" log -1 --pretty=%B
+    assert_line "message rewritten by hook"
+}