Fail on modified files (when not staging them)

[scop]

lefthook newbie here, just started to dabble with it. Long experience with pre-commit.

One thing I'm used to and missing in lefthook is the ability to fail on modified ("fixed") staged files on pre-commit. As far as I understand:

1. The current default behavior of leaving "fixes" in place and exiting with zero status:
   • does not prevent a commit from going through, which is not nice, it results in possible CI failures and need for followup commits or manual amending
   • is not useful when running in CI without an additional diffing step
2. stage_fixed: true is pretty nice and convenient for some scenarios, but:
   • depending on a tool it can be dangerous, and/or one may want to review the changes before staging and committing them
   • it is not useful when running in CI without an additional diff (or commit+push 😱) step

Some tools can be made to exit with nonzero exit status when they modify files, which kind of serves as a workaround for the former. Shell scripting or something like that could be used to make the exit status nonzero if there are modified files, but shell scripting is not portable, and IMHO this is something one should not have to script, but should Just Work :)

So, I would like to propose making it possible to exit with nonzero status when a tool made any modifications to the tree. Given green field, I'd personally make that the default (maybe even without ability to turn it off :)), but I understand this would be a backwards incompatible change.

Therefore, perhaps a new config option fail_fixed (default false), which if true, would cause a nonzero exit status if there were any modified files in the tree as a result of some command, no matter what stage_fixed is set to (stage_fixed: true could do its thing together with this option, no need to prevent it).

Alternatively, if it would be possible to specify multiple runs for a single command, that could be used to achieve this by just adding a git diff --exit-code command as the last. But that'd open the can of worms of having to specify whether these runs run only up to the one that failed, or all no matter what the exit status of the previous one is, and would not thus work for all tools/cases.

Thoughts? Am I missing something that makes the above possible already?