From fdf80816e27e5c22e54cd3f4cf6205e3c80e470e Mon Sep 17 00:00:00 2001 From: ciregenz Date: Tue, 19 May 2026 11:21:54 -0700 Subject: [PATCH] [eric] ci: skip gitleaks scan when new-branch push has no commits ahead of main Workflow's new-branch fallback fell through to a full repo scan whenever merge-base with main equaled HEAD (empty range). That re-flagged every historical secret a prior PR had already cleared. Now: empty range means nothing new to scan, log + exit clean. Genuine no-shared-history case still falls through to full scan. --- .github/workflows/gitleaks.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 95fb5eaa..ef2e02de 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -59,7 +59,14 @@ jobs: fi if [ -n "$BEFORE" ] && [ "$BEFORE" != "$AFTER" ]; then gitleaks detect --source . --redact --verbose --no-banner --log-opts="${BEFORE}..${AFTER}" + elif [ "$BEFORE" = "$AFTER" ]; then + # New-branch push pointing at an existing main commit: range + # is empty, nothing new to scan. Don't fall through to a full + # repo scan — that would re-flag every historical secret a + # past PR already cleared. Pass-through. + echo "No new commits on this branch vs main; skipping scan." else - # Couldn't establish a range — full scan as fallback. + # Truly couldn't establish a range (e.g. orphan branch with + # no shared history). Full scan is the only safe option. gitleaks detect --source . --redact --verbose --no-banner fi