Skip to content

Skip staged submodule pins (gitlinks) in secret-scan.sh #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexander-yevsyukov merged 3 commits into from
Jun 24, 2026
Merged

Skip staged submodule pins (gitlinks) in secret-scan.sh #25

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2341988
Skip module references in `secret-scan.sh`
alexander-yevsyukov Jun 23, 2026
3f79ae2
Address review: use grep (not awk) for the gitlink mode check
alexander-yevsyukov Jun 23, 2026
0d77793
Address review: resolve the gitlink mode lookup from the repo root
alexander-yevsyukov Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions scripts/secret-scan.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,17 @@ case "$mode" in
# so a `git mv clean credentials.properties` cannot slip past via R.
while IFS= read -r -d '' path; do
[ -n "$path" ] || continue
# A staged submodule pointer (gitlink, mode 160000) is a commit SHA, not
# file content: `git show :path` cannot materialize it as a blob and it
# cannot carry a secret. Skip it instead of failing closed below. Match
# the mode per-line with `grep` (already required above; `awk` is not) so
# an unmerged index's multi-stage output can't defeat the check, and run
# the lookup with `-C "$repo_root"` so the repo-root-relative `$path` from
# `git diff --cached` resolves even when the scanner runs from a subdir
# (the same reason the worktree/tracked-modified modes use `-C`).
if git -C "$repo_root" ls-files --stage -- "$path" 2>/dev/null | grep -q '^160000 '; then
continue
fi
blob=$(mktemp) || { echo "secret-scan: cannot create temp file." >&2; exit 3; }
if ! git show ":$path" > "$blob" 2>/dev/null; then
rm -f "$blob"
Expand Down