Usefulness of --pre-commit flag in git subcommand

[pantelis-karamolegkos]

I have created a file with a secret within a locally cloned .git repo.

I have already run git add test.txt (test.txt being the file that contains the secret)

$ git status

On branch test-secrets
Changes to be committed:
  (use "git restore --staged <file>..." to unstage)
	new file:   test.txt

Here are some executions

$ gitleaks git --staged --pre-commit --no-banner
5:08PM INF 1 commits scanned.
5:08PM INF scanned ~63 bytes (63 bytes) in 36.9ms
5:08PM WRN leaks found: 1

$ gitleaks git --staged --no-banner
5:09PM INF 1 commits scanned.
5:09PM INF scanned ~63 bytes (63 bytes) in 36ms
5:09PM WRN leaks found: 1

$ gitleaks git --pre-commit --no-banner
5:09PM INF 0 commits scanned.
5:09PM INF scanned ~0 bytes (0) in 37.7ms
5:09PM INF no leaks found

So at the end of the day what does the --pre-commit do?

[bplaxco]

Based on the code in cmd/git.go it looks like --staged implies --pre-commit. The --pre-commit command just does a scan against the git diff instead of the history.

--pre-commit without --staged looks like it scans unstaged changes.