fix(security): scope TruffleHog hook to staged files only#35
Conversation
Replace `trufflehog git file://. --since-commit HEAD` with a staged-files scan via `git diff --cached | xargs trufflehog filesystem`. The git-history mode also traverses fetched remote branches in the local object store, which produces false positives from placeholder credentials in unmerged branches. See `.claude/rules/pre-commit.md` invariant `PC-HOOK-STAGED-SCOPE` for the general principle (pre-commit hooks must scope to staged files only; full-history scanning belongs in CI). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 29 minutes and 40 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
There was a problem hiding this comment.
Pull request overview
Updates the local pre-commit TruffleHog hook to scope scanning to staged files instead of using trufflehog git ... --since-commit HEAD, aligning the hook’s behavior with pre-commit-time expectations for secret scanning.
Changes:
- Replace TruffleHog git-history invocation with a staged-files-based invocation.
- Add inline documentation explaining why staged-file scope is preferred for pre-commit.
| entry: bash -c 'command -v trufflehog >/dev/null 2>&1 && (git diff --cached -z --diff-filter=d --name-only 2>/dev/null | xargs -0 -r trufflehog filesystem --fail --no-update --results=verified,unknown) || echo "TruffleHog not installed - skipping secret scan"' | ||
| language: system | ||
| pass_filenames: false |
Summary
Replace
trufflehog git file://. --since-commit HEADwith a staged-files form.Why
Resolves observation #4 from the skill observation log; part of the fleet-wide
TruffleHog rollout. See
.claude/rules/pre-commit.mdPC-HOOK-STAGED-SCOPE.Generated with Claude Code