Currently, scripted diffs may silently pass with errors.
Fix this issue by calling the script from a Bash instance with error checking enabled: bash -o errexit -o nounset -o pipefail -c "$SCRIPT".
Also, use Bash (not sh) when launching the script itself, because Bash is required anyway.
Can be tested by running something like this and observing the behavior before and after:
git commit --allow-empty -m $'scripted-diff: foo\n\n-BEGIN VERIFY SCRIPT-\n false;falseasfsafsaf;true;false|cat; echo "${NO_UN_SET}"|cat \n-END VERIFY SCRIPT-\n' && ./test/lint/commit-script-check.sh HEAD~..HEAD ; echo $?
Alternatively, an ancient brittle script can be tested:
./test/lint/commit-script-check.sh fb65dde147f63422c4148b089c2f5be0bf5ba80f~..fb65dde147f63422c4148b089c2f5be0bf5ba80f