c5b3a50dbb
secrets.sh exits 2 for "nothing was scanned", which is the right answer for a commit that only deletes files — a deletion has no added lines to look at. The hook treated any non-zero as a refusal and printed "possible credential in the staged changes" while doing it. So `git rm` was impossible, and the message pointed at a security problem that did not exist. Found while removing a bin/ directory that had been committed by accident; the commit only went through because a .gitignore edit happened to be staged alongside it, which gave the scanner something to read. The safety property is kept rather than traded away: a 2 still refuses whenever the staged diff adds any lines, because then the scanner did have something to look at and checking nothing is exactly the failure exit 2 exists to report. |
||
|---|---|---|
| .. | ||
| commit-msg | ||
| post-commit | ||
| pre-commit | ||