fix: add file package for binary detection, document shallow-clone tradeoff
All checks were successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/pr/ci Pipeline was successful

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude 2026-04-15 21:03:05 +00:00
parent d020847772
commit 88b377ecfb
2 changed files with 4 additions and 2 deletions

View file

@ -23,7 +23,9 @@ SECRET_PATH_PATTERNS=(
path_regex=$(printf '%s|' "${SECRET_PATH_PATTERNS[@]}") path_regex=$(printf '%s|' "${SECRET_PATH_PATTERNS[@]}")
path_regex="${path_regex%|}" path_regex="${path_regex%|}"
# Get files changed in this PR vs target branch # Get files changed in this PR vs target branch.
# Note: shallow clone (depth 50) may lack the merge base for very large PRs,
# causing git diff to fail — || true means the gate skips rather than blocks.
changed_files=$(git diff --name-only --diff-filter=ACMR "origin/${CI_COMMIT_TARGET_BRANCH}...HEAD" || true) changed_files=$(git diff --name-only --diff-filter=ACMR "origin/${CI_COMMIT_TARGET_BRANCH}...HEAD" || true)
if [ -z "$changed_files" ]; then if [ -z "$changed_files" ]; then

View file

@ -28,5 +28,5 @@ steps:
- name: secret-scan - name: secret-scan
image: alpine:3 image: alpine:3
commands: commands:
- apk add --no-cache bash git grep - apk add --no-cache bash git grep file
- bash .woodpecker/run-secret-scan.sh - bash .woodpecker/run-secret-scan.sh