From e947600ea7377bfa4f3583f3f019be2ac4e407c3 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Sun, 28 Jun 2026 02:35:11 -0500 Subject: [PATCH] fix: log error when pre-receive secret scan cannot read commit Previously, GetCommit failures were silently swallowed, allowing pushes to proceed without scanning. Now logs the error so admins can diagnose issues while still allowing the push. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd --- routers/private/hook_pre_receive.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/routers/private/hook_pre_receive.go b/routers/private/hook_pre_receive.go index e7ccff06e8..0da5d3a65b 100644 --- a/routers/private/hook_pre_receive.go +++ b/routers/private/hook_pre_receive.go @@ -154,7 +154,9 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r if newCommitID != objectFormat.EmptyObjectID().String() { newCommit, err := gitRepo.GetCommit(newCommitID) - if err == nil { + if err != nil { + log.Error("Secret scan: failed to get commit %s in %-v: %v", newCommitID[:12], repo, err) + } else { if findings := security_service.ScanPushForSecrets(ctx, repo.ID, newCommit); len(findings) > 0 { msg := fmt.Sprintf("Push rejected: %d secret(s) detected in commit %s", len(findings), newCommitID[:12]) for _, f := range findings {