feat(hooks): scan the pushed revision range in pre-push - #112
Merged
Merged
Conversation
pixincreate
force-pushed
the
fix/scanner-strictness
branch
from
September 14, 2026 16:14
bafc920 to
7c20d43
Compare
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
2 times, most recently
from
September 14, 2026 16:17
0e6c802 to
03eac20
Compare
pixincreate
force-pushed
the
fix/scanner-strictness
branch
from
September 14, 2026 16:19
03f8330 to
73acc0a
Compare
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:19
03eac20 to
dbbd9ee
Compare
pixincreate
force-pushed
the
fix/scanner-strictness
branch
from
September 14, 2026 16:22
73acc0a to
f23d1a6
Compare
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:22
dbbd9ee to
38ad3d3
Compare
The pre-push hook scanned the working tree (scan .), which blocked pushes over uncommitted local files and missed secrets living in pushed commits but already removed from the tree. git hands pre-push one line per ref on stdin (<local ref> <local sha> <remote ref> <remote sha>); the hook now scans exactly that range per ref with scan --git-history --rev-range. - Ref deletions are skipped: they push no content. - A new ref, or a remote tip that is not present locally (never fetched, or pruned), falls back to the ref's full reachable history rather than failing on an invalid range. - Scans run with stdin closed so a child process can never swallow the remaining ref lines of a multi-ref push. - Exit 1 (secret found) and exit 2 (scan failed) produce distinct messages per ref; both keep blocking the push, and the inspect hint includes --no-config-discovery so a repository config cannot make the suggested command report clean. The hook execution tests now drive the stdin protocol against real commits instead of asserting on a worktree scan. Assisted-by: Claude Fable 5 Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
The reworked hook tests commit fixture secrets inside temporary repositories, and their sample lines in tests/hooks_tests.rs are new scan findings. Regenerated so the CI baseline drift check stays green. Assisted-by: Claude Fable 5 Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:29
38ad3d3 to
fb1ea4f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked PR 4 of 5 (base:
fix/scanner-strictness).The pre-push hook scanned the working tree, which blocked pushes over uncommitted files and missed secrets in pushed commits that were already removed from the tree. It now reads the pushed refs from stdin and scans exactly the pushed range per ref with
scan --git-history --rev-range.Ref deletions are skipped. A new ref, or a remote tip not present locally, falls back to the ref's full history instead of failing on an invalid range. Scans run with stdin closed so a child process cannot swallow the remaining ref lines. Secret findings and scanner failures produce distinct messages; both block the push.