Fix pre-commit hook by use git-agnostic file-based checking #1918
Conversation
This fixes gitleaks invocations via pre-commit when there are no changed to-be-committed (i.e., via `pre-commit run --files` or `pre-commit run --all-files`). Currently, these will pass even if there would be gitleaks findings because `gitleaks git` checks the diff only. When called via pre-commit framework, gitleaks does not need to git-aware because the framework already detects which files need to be checked (either the diff when a commit range or changes that are about-to-be-committed are checked, or the files passed to the `--files` command line argument). Fixes gitleaks#1409.
We move these flags from `entry` to `args` to allow users to override them in their `.pre-commit-config.yaml` in case they want to use different flags.
|
Hello ! Have you check the whole discussion in #1409 ? Especially this comment. I've hold off from opening the same PR as you because it's not working as you think it will and the whole project directory will be checked on every commit that contains more than 1 files because of the bug outlined in #1727. |
|
Yes, I've noticed that it's very slow. Is there an ETA for #1727? If you expect that it will take a while, maybe we should consider to merge this PR as-is. Because it is somewhat unexpected that |
No Idea, I'm waiting for it to solve the pre-commit use case but I'm not a maintainer nor have enough go knowledge to help with the review.
Unfortunately, this would cause very huge latency for the most common use case of this hook ie running before a commit on changed files. For exemple on my repo, it would make the $ hyperfine -i "gitleaks dir --redact --verbose" "gitleaks git --pre-commit --redact --staged --verbose"
Benchmark 1: gitleaks dir --redact --verbose
Time (mean ± σ): 30.943 s ± 0.527 s [User: 179.861 s, System: 9.130 s]
Range (min … max): 30.232 s … 31.886 s 10 runs
Warning: Ignoring non-zero exit code.
Benchmark 2: gitleaks git --pre-commit --redact --staged --verbose
Time (mean ± σ): 342.3 ms ± 3.7 ms [User: 330.6 ms, System: 25.2 ms]
Range (min … max): 337.6 ms … 350.6 ms 10 runs
Summary
'gitleaks git --pre-commit --redact --staged --verbose' ran
90.40 ± 1.82 times faster than 'gitleaks dir --redact --verbose'
I completely agree with you this is very unexpected that |
Description:
This fixes gitleaks invocations via pre-commit when there are no changed to-be-committed (i.e., via
pre-commit run --filesorpre-commit run --all-files). Currently, these will pass even if there would be gitleaks findings becausegitleaks gitchecks the diff only.When called via pre-commit framework, gitleaks does not need to git-aware because the framework already detects which files need to be checked (either the diff when a commit range or changes that are about-to-be-committed are checked, or the files passed to the
--filescommand line argument).Fixes #1409.
Checklist: