GitHub Copilot With Pre-Commit Hooks: Suggested Patterns

Developers who use GitHub Copilot often generate code that does not meet project linting, formatting, or security rules. Pre-commit hooks catch these issues before a commit reaches the remote repository. The challenge is that Copilot suggestions can bypass these hooks if the developer commits generated code without review. This article explains how to configure pre-commit hooks to validate Copilot-generated code, suggests patterns for hook rules that target common Copilot output, and shows how to integrate Copilot with hook-driven workflows. You will learn concrete hook configurations for Python, JavaScript, and TypeScript projects.

How Pre-Commit Hooks Interact With Copilot-Generated Code

Pre-commit hooks are scripts that run automatically before a commit is finalized. They check staged files for issues such as syntax errors, style violations, or security vulnerabilities. When a developer accepts a Copilot suggestion and stages that file, the hook runs against the staged version. If the hook fails, the commit is blocked until the developer fixes the issue. This prevents flawed generated code from entering the repository.

The interaction has two key aspects. First, Copilot often generates code that does not match the project’s existing style guide. For example, it might use single quotes in a JavaScript project that enforces double quotes. A formatting hook like Prettier catches this. Second, Copilot may introduce unused imports or variables, especially when suggesting large blocks of code. A linting hook such as ESLint or Flake8 flags these. The developer then reviews and corrects the suggestion before committing.

A common misconception is that hooks make Copilot unusable. The opposite is true. Hooks act as a safety net, catching issues that the developer might miss during a quick review. The developer can still accept Copilot suggestions, run the hooks, and fix any violations. This workflow keeps the repository clean while allowing the developer to benefit from Copilot’s speed.

Suggested Hook Patterns for Copilot Code Validation

The following patterns focus on the most common issues that Copilot-generated code introduces. Each pattern includes a hook configuration and an explanation of why it matters for Copilot output.

Pattern 1: Enforce Consistent Formatting With Prettier

Copilot does not respect your project’s formatting rules. It uses its own training distribution, which may use different quote styles, trailing commas, or indentation. Prettier reformats all staged code to match the project’s configuration. Add this to your .pre-commit-config.yaml:

- repo: https://github.com/pre-commit/mirrors-prettier
  rev: v3.0.0
  hooks:
    - id: prettier
      args: [--config, .prettierrc]

The args field points to your project’s Prettier config file. This hook runs on JavaScript, TypeScript, CSS, JSON, and Markdown files. It reformats the file in place, so the developer sees the formatted version before the commit goes through.

Pattern 2: Remove Unused Imports and Variables With ESLint

Copilot often adds imports that the generated code does not use. This happens because Copilot predicts the next token without understanding the full context of the file. ESLint with the no-unused-vars rule catches these. Add this hook:

- repo: https://github.com/pre-commit/mirrors-eslint
  rev: v8.50.0
  hooks:
    - id: eslint
      args: [--fix, --config, .eslintrc.js]
      types: [javascript]

The --fix flag tells ESLint to automatically remove unused imports and variables. If ESLint cannot fix a rule violation, it fails the commit and shows the error. The developer then manually corrects the Copilot suggestion.

Pattern 3: Detect Hardcoded Secrets With detect-secrets

Copilot may suggest code that contains hardcoded API keys, passwords, or tokens. This is especially risky when Copilot generates configuration files or test data. The detect-secrets hook scans staged files for potential secrets. Add this hook:

- repo: https://github.com/Yelp/detect-secrets
  rev: v1.4.0
  hooks:
    - id: detect-secrets
      args: [--baseline, .secrets.baseline]

Run detect-secrets scan once to create a baseline file that excludes known false positives. After that, the hook only flags new secrets. If Copilot generates a line that looks like a secret, the hook fails and the developer must replace the hardcoded value with an environment variable.

Pattern 4: Check for License Headers With add-license

Some projects require a license header in every source file. Copilot does not add headers. The add-license hook inserts the header if it is missing. Add this hook:

- repo: https://github.com/nicoddemus/add-license
  rev: v1.0.0
  hooks:
    - id: add-license
      args: [--license, LICENSE]
      types: [python]

The hook reads the license text from a file named LICENSE and prepends it to any file that lacks it. This ensures that Copilot-generated files comply with project licensing requirements.

Pattern 5: Validate TypeScript Types With tsc

Copilot may generate TypeScript code that uses incorrect types or missing type definitions. Running the TypeScript compiler as a pre-commit hook catches type errors. Add this hook:

- repo: https://github.com/pre-commit/mirrors-typescript
  rev: v5.2.2
  hooks:
    - id: tsc
      args: [--noEmit, --project, tsconfig.json]

The --noEmit flag tells the compiler to check types without generating output files. If Copilot suggests a function with mismatched types, the hook fails and shows the error message. The developer then adjusts the type annotations.

Common Issues and How to Handle Them

Even with properly configured hooks, you may encounter specific problems when using Copilot with pre-commit hooks. The following subsections address the most frequent scenarios.

Copilot Suggests Code That Passes Hooks but Has Logic Errors

Pre-commit hooks check syntax, formatting, and style. They do not verify correctness. A Copilot suggestion that passes all hooks may still contain a logic error, such as an off-by-one loop or an incorrect algorithm. The developer must manually review the generated code. A good practice is to run the project’s test suite after committing. If the test suite is fast, add it as a pre-commit hook using a custom entry point. For example, use entry: pytest for Python projects. This catches logic errors before the commit is finalized.

Hooks Block Commits That Include Copilot-Generated Boilerplate

Copilot often generates boilerplate code such as import statements, class definitions, or test fixtures. Some hooks, like the license header hook, may fail because the generated file lacks the header. Other hooks, like the unused-import hook, may fail because Copilot added unused imports. The developer should run the hooks with the --fix flag where possible. For hooks that cannot auto-fix, the developer must manually edit the file. To reduce friction, configure hooks to auto-fix the most common issues. For example, ESLint with --fix removes unused imports automatically.

Copilot Generates Code That Violates Custom ESLint Rules

If your project uses custom ESLint rules, Copilot may generate code that violates them. For instance, a rule that forbids console.log will flag Copilot-generated debug statements. The developer should review the Copilot suggestion and remove the debug statements before committing. If the violation is intentional, the developer can add an ESLint disable comment and document the reason. However, avoid disabling rules for Copilot-generated code as a habit. This defeats the purpose of the hook.

Pre-Commit Hook Configuration vs Manual Review: Key Differences

Item	Pre-Commit Hook Configuration	Manual Review Only
Speed	Automated, runs in seconds	Slower, depends on reviewer availability
Consistency	Applies same rules to every commit	Varies by reviewer attention and experience
Coverage	Catches formatting, unused imports, secrets	Catches logic errors, design issues
Developer friction	May block commits until fixes are applied	No automatic blocking, but issues may reach production
Best for	Enforcing code style and security policies	Validating correctness and architecture

Conclusion

You can now configure pre-commit hooks to validate Copilot-generated code for formatting, unused imports, secrets, license headers, and TypeScript types. The five patterns in this article cover the most common issues that Copilot introduces. Start by adding the Prettier and ESLint hooks to your .pre-commit-config.yaml file. Run pre-commit install to activate the hooks. For advanced validation, add the TypeScript compiler hook and the detect-secrets hook. Always review Copilot suggestions manually to catch logic errors that hooks cannot detect.