Skip staged submodule pins (gitlinks) in secret-scan.sh

[alexander-yevsyukov]

Problem

The shared pre-commit hook runs secret-scan.sh staged, which loops over every
staged path and runs git show :<path> to materialize and scan its content. When a
submodule pin is staged, that path is a gitlink (mode 160000) in the index —
a commit SHA, not a file blob — so git show :<path> fails. Because the scanner is
deliberately fail-closed, an unreadable "blob" makes it abort:

secret-scan: cannot read staged blob for 'config'; refusing to report clean.

…which blocks the commit entirely.

Why it surfaced now

It only bites when a submodule pin changes and gets staged. In gcloud-jvm, the
SessionStart config-float moved the config pin (904c1603 → a95c42a9), and
IntelliJ's git add -A staged that pin change. It would recur in any Spine repo
whenever a submodule pin is committed.

Fix

Skip gitlinks before the blob read in the staged loop:

# A staged submodule pointer (gitlink, mode 160000) is a commit SHA, not
# file content: `git show :path` cannot materialize it as a blob and it
# cannot carry a secret. Skip it instead of failing closed below.
if [ "$(git ls-files --stage -- "$path" 2>/dev/null | awk '{print $1}')" = 160000 ]; then
  continue
fi

git ls-files --stage reads the mode from the index, so it works even though the
submodule's commit object isn't present in the superproject. Genuine blobs still take
the fail-closed path unchanged — a gitlink can't carry a secret, so skipping it is safe.

Verification

• bash -n parses clean.
• Staged gitlink only → exit 0 (was exit 3 before the fix).
• Staged gitlink + a real staged secret → exit 2: real blobs are still scanned,
  so the skip doesn't open a hole.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the shared scripts/secret-scan.sh staged scanner to avoid aborting when a staged path is a submodule gitlink (mode 160000), which cannot be materialized via git show :path and therefore should be safely skipped.

Changes:

• Add a staged-path pre-check to detect gitlinks (submodule pointers) and skip them before attempting git show :path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2341988ebd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.