Repository navigation
Stop the secret scan failing on commit counts that end in zero - #5
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The secret-scan coverage check matched the substring
0 commits scanned, so any commit count ending in zero (10, 1600 and so on) failed the job even when the scan ran and found nothing.It now requires exactly one commit count in the log and fails unless that count is provably above zero. A zero, missing, repeated or non-numeric count all fail closed; the inverted test also fails when the value cannot be read as an integer, where the earlier form passed. A
[git]error line and a real leak fail as before. The extraction ends in|| true, so the step still reaches its error message if the job's shell ever gainspipefail.Tested by running the step from this workflow file under
bash -e, and again withpipefail, against a stub for each case: counts of 1, 10, 1599 and 1600 with no leaks pass; zero commits, a missing count, no output, git stderr with a nonzero count, a found leak, an oversized count, and a zero followed by a later count all fail. Run for real against this repository, gitleaks scanned 1602 commits, found no leaks, and the step passed.