Where Does Overcommit Store Its Config?
Overcommit reads hook rules from .overcommit.yml at the repo top, with personal overrides in gitignored .local-overcommit.yml.
Last updated
Overcommit keeps repo hooks in .overcommit.yml: which checks run per hook type, their commands, includes and signage. overcommit --install plants the git shims; the yml decides what they execute.
The signature system is the part everyone trips on. Any config edit invalidates the recorded signature until --sign re-blesses it, which stops malicious hook changes from riding in via innocent looking PRs.
Where Overcommit stores this, by platform
[RepoDir]/.overcommit.yml
Hook enablement, commands, gemfile binding. Installed shims live in .git/hooks; the yml is the source of truth they consult.
[RepoDir]/.overcommit.yml
Same pair. verify_signatures defaults on for good reason; disabling it repo-wide trades one setup annoyance for real supply chain exposure.
Frequently asked questions
Commits fail after I edited .overcommit.yml. What now?
Run overcommit --sign after every .overcommit.yml change. Signature verification blocks tampered hook configs, and unsigned edits fail closed on the next commit.
Can I customize hooks without touching the shared config?
Put personal tweaks in .local-overcommit.yml (same schema, gitignored). It layers over the shared file, so local experiments never leak into the team's hooks.
Notice an outdated path? Let us know.