fix: add file package for binary detection, document shallow-clone tradeoff
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
d020847772
commit
88b377ecfb
2 changed files with 4 additions and 2 deletions
|
|
@ -23,7 +23,9 @@ SECRET_PATH_PATTERNS=(
|
||||||
path_regex=$(printf '%s|' "${SECRET_PATH_PATTERNS[@]}")
|
path_regex=$(printf '%s|' "${SECRET_PATH_PATTERNS[@]}")
|
||||||
path_regex="${path_regex%|}"
|
path_regex="${path_regex%|}"
|
||||||
|
|
||||||
# Get files changed in this PR vs target branch
|
# Get files changed in this PR vs target branch.
|
||||||
|
# Note: shallow clone (depth 50) may lack the merge base for very large PRs,
|
||||||
|
# causing git diff to fail — || true means the gate skips rather than blocks.
|
||||||
changed_files=$(git diff --name-only --diff-filter=ACMR "origin/${CI_COMMIT_TARGET_BRANCH}...HEAD" || true)
|
changed_files=$(git diff --name-only --diff-filter=ACMR "origin/${CI_COMMIT_TARGET_BRANCH}...HEAD" || true)
|
||||||
|
|
||||||
if [ -z "$changed_files" ]; then
|
if [ -z "$changed_files" ]; then
|
||||||
|
|
|
||||||
|
|
@ -28,5 +28,5 @@ steps:
|
||||||
- name: secret-scan
|
- name: secret-scan
|
||||||
image: alpine:3
|
image: alpine:3
|
||||||
commands:
|
commands:
|
||||||
- apk add --no-cache bash git grep
|
- apk add --no-cache bash git grep file
|
||||||
- bash .woodpecker/run-secret-scan.sh
|
- bash .woodpecker/run-secret-scan.sh
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue