cargo-husky is a regular dependency

[sagikazarmark]

cargo-husky is declared under [dependencies] in Cargo.toml:

https://github.com/akinsella/yt-transcript-rs/blob/main/Cargo.toml#L41

cargo-husky = { version = "1.5.0", features = ["precommit-hook", "run-cargo-fmt", "run-cargo-clippy", "run-cargo-check"] }

It is also already declared where it belongs, under [dev-dependencies] at line 49.

Why this is a problem

cargo-husky does all its work in a build script: it walks up from OUT_DIR until it finds a .git directory, then writes hook files into it. That is safe as a dev-dependency, because dev-dependencies of a transitive dependency are never built — only the crate's own developers ever run it, against their own repo.

As a regular dependency it is built in every downstream consumer, so the build script runs during their build, resolves their .git directory, and installs hooks into their repository.

Because default features are not disabled, consumers get the union of the listed features and cargo-husky's defaults (prepush-hook, run-cargo-test, run-for-all) — hence both a pre-commit and a pre-push hook, each running the full four-command suite with --all across the consumer's entire workspace.

The practical effect on an unrelated project is that every commit and every push starts running that project's full test, clippy and fmt suite, under lint settings it never opted into, with no indication of where the hooks came from beyond the generated comment.

Suggested fix

Delete the [dependencies] entry (line 41) and move its feature list onto the existing [dev-dependencies] entry (line 49):

[dev-dependencies]
cargo-husky = { version = "1.5.0", features = ["precommit-hook", "run-cargo-fmt", "run-cargo-clippy", "run-cargo-check"] }

The hooks keep working for contributors to this repo, and consumers stop building cargo-husky at all.

Workaround for consumers

Until a fixed release is published, add to .cargo/config.toml:

[env]
CARGO_HUSKY_DONT_INSTALL_HOOKS = "1"

and delete the already-installed .git/hooks/pre-commit and .git/hooks/pre-push.

Observed on yt-transcript-rs 0.1.8 (current latest on crates.io).

[webbrain-one]

Thanks for the detailed report! I’ve opened a PR that moves cargo-husky from [dependencies] to [dev-dependencies]. This will prevent the build script from running—and accidentally installing git hooks—for downstream consumers, while keeping the pre-commit checks active for contributors to this repo. Let me know if you have any feedback!

[sagikazarmark]

Thanks @webbrain-one !