Skip to content

gitleaks does not scan correct files with pre-commit run --files #1409

@krakeusz

Description

@krakeusz

Describe the bug
gitleaks pre-commit hook scans the staged files instead of the files that pre-commit requests to scan.

To Reproduce
Steps to reproduce the behavior:

# assuming pre-commit 2.21.0, go 1.22.3
mkdir -p precommit-reproduce
rm -rf precommit-reproduce/*
cd precommit-reproduce
git init
cat > .pre-commit-config.yaml <<EOF
repos:
- repo: https://github.com/gitleaks/gitleaks
  rev: v8.18.2
  hooks:
    - id: gitleaks
EOF
echo "export BUNDLE_ENTERPRISE__CONTRIBSYS__COM=cafebabe:deadbeef" > leak.go
git add .pre-commit-config.yaml leak.go
git commit -m "Initial commit with a leak"
pre-commit install
pre-commit run --files leak.go   # succeeds, but should not

echo "export BUNDLE_ENTERPRISE__CONTRIBSYS__COM=cafebabe:deadbeef" >> leak.go
git add leak.go
# This one fails as expected.
git commit -m "Add another leak"

Expected behavior

  • pre-commit run --files leak.go should fail with a message about a leak

Screenshots
none

Basic Info (please complete the following information):

  • OS: Ubuntu 20.04
  • Gitleaks Version: 8.18.2

Additional context

pre-commit run --files is a use case eg. in merge-gate scenario in CI. A generic way of running pre-commit on all changed files in a PR is to git diff the changes between source and target branch, then feed the list to pre-commit.

The workaround is probably to use gitleaks-action or to write custom code which creates a scan baseline. But couldn't gitleaks accept a list of files to scan, so that it integrates nicely with less-commonly-used commands of pre-commit?

cc @zricethezav

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions