awslabs / awslabs/git-secrets

git merge with removed secrets in diff causes commit to fail

Open
#188 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
13.4k
Forks
1.3k
PR merge metrics
No merged PRs in 30d

Description

Steps to reproduce:
1. create git repo
2. commit some secrets on branch X
3. create branch Y which removes those secrets
3. merge Y into X: `git checkout X && git merge Y --no-ff` (a fast forward would happen for this simple case, let's skip that)

if it matters, `alias gm='git merge'`
![img](https://user-images.githubusercontent.com/48314306/97979638-31c3f780-1dd8-11eb-88d4-c494531c6418.png)

Mac OSX Catalina, using git 2.25.0 creates a diff after the comments for a `git merge`:
![Image 2020-11-03 13-10-05](https://user-images.githubusercontent.com/48314306/97978381-296abd00-1dd6-11eb-969e-08a4218db77b.png)
The diff after the separator is NOT included in the actual commit message, but presumably because it is fed through STDIN, git-secrets refuses to commit. Additionally, `git merge --no-verify` does not seem to work (`git commit --no-verify` does work)

Contributor guide

Open the contributing guide

Research direction

Reproduce the report with git merge --no-ff after committing and then removing a secret, using git-secrets on macOS or an equivalent setup. Start by tracing how the merge hook receives STDIN and handles the diff after the commit-message separator, then compare git merge --no-verify with git commit --no-verify. Done means the merge succeeds without scanning non-message diff content, while secret checks remain effective.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, shell
Domain
security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.