Problem

The shared pre-commit hook runs secret-scan.sh staged, which loops over every
staged path and runs git show :<path> to materialize and scan its content. When a
submodule pin is staged, that path is a gitlink (mode 160000) in the index —
a commit SHA, not a file blob — so git show :<path> fails. Because the scanner is
deliberately fail-closed, an unreadable "blob" makes it abort:

secret-scan: cannot read staged blob for 'config'; refusing to report clean.

…which blocks the commit entirely.

Why it surfaced now

It only bites when a submodule pin changes and gets staged. In gcloud-jvm, the
SessionStart config-float moved the config pin (904c1603 → a95c42a9), and
IntelliJ's git add -A staged that pin change. It would recur in any Spine repo
whenever a submodule pin is committed.

Fix

Skip gitlinks before the blob read in the staged loop:

# A staged submodule pointer (gitlink, mode 160000) is a commit SHA, not
# file content: `git show :path` cannot materialize it as a blob and it
# cannot carry a secret. Skip it instead of failing closed below.
if [ "$(git ls-files --stage -- "$path" 2>/dev/null | awk '{print $1}')" = 160000 ]; then
  continue
fi

git ls-files --stage reads the mode from the index, so it works even though the
submodule's commit object isn't present in the superproject. Genuine blobs still take
the fail-closed path unchanged — a gitlink can't carry a secret, so skipping it is safe.

Verification

• bash -n parses clean.
• Staged gitlink only → exit 0 (was exit 3 before the fix).
• Staged gitlink + a real staged secret → exit 2: real blobs are still scanned,
  so the skip doesn't open a hole.

🤖 Generated with Claude Code