CLI-298 git pre push

[kirill-knize-sonarsource]

No description provided.

[hashicorp-vault-sonar-prod]

CLI-298

[sonar-review-alpha]

Summary

This PR moves the git pre-push secret scanning logic from shell scripts into TypeScript. Previously, the scan was implemented as inline shell code embedded in git hook scripts. Now it's a proper CLI command (sonar hook git-pre-push) that parses stdin refs, determines which files are being pushed, and scans them via the existing secrets binary.

The refactoring simplifies the hook scripts (both native .git/hooks/ and Husky) to a single line that invokes the new command, making the logic testable and maintainable. Three integration tests and 15 unit tests verify correct behavior for new branches, existing branch updates, secret detection, graceful skips (auth/binary not available), and edge cases like branch deletion and malformed input.

What reviewers should know

Where to start:

• Read src/cli/commands/hook/git-pre-push.ts — the main logic that orchestrates the scan
• Check src/cli/commands/hook/stdin.ts — how push refs are parsed from git's stdin format

Key details for reviewers:

1. Ref parsing — Git sends refs as space-separated lines: <localRef> <localSha> <remoteRef> <remoteSha>. The code filters out malformed lines and handles the null OID (0000...0000) for branch deletions and new branches.

2. File discovery differs by ref type:

   • Existing branch push → git diff remoteSha localSha to find changed files
   • New branch push (remoteSha is null OID) → git rev-list to find new commits, then diff each; falls back to empty-tree diff if no other remotes exist

3. Graceful skip behavior is intentional — If auth fails, binary isn't installed, or git commands error out, the hook returns 0 (allow the push). Only CommandFailedError from the secrets scan itself fails the hook.

4. Empty tree handling — Calls git mktree once per push to get the canonical empty tree; this correctly handles both SHA-1 and SHA-256 repos. Falls back to null OID if mktree fails.

5. Integration with shell — The native and Husky hook scripts now just find SONAR_BIN and invoke "$SONAR_BIN" hook git-pre-push. This keeps the scripts simple and readable.

6. Test coverage — Integration tests use real git repos; unit tests mock git/auth/binary calls. Watch for the test in git.test.ts that updated an error message from 'Secrets found' to 'Secrets detected'.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[eray-felek-sonarsource]

1 comment otherwise tested and LGTM

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
1 New dependency risk

Measures
0 Security Hotspots
96.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback