pre-commit only sees the commit being made, so a key committed with
--no-verify or from a clone without the hooks still reached the
remote. pre-push applies the same rules to every commit being
pushed, not just the tip: a key removed in a later commit still
lands in the remote history.
pre-commit: `grep -q` exited early and, under pipefail, turned a
match into a pass when a long diff followed the key; a config.ini
without an X_KEY line made the hook fail silently.
Çağan Kiraz
85b4b27ab3