From ceaa280fa27d5b6b2e3a1da3e0cb54a5c5c108a8 Mon Sep 17 00:00:00 2001 From: JorisJonkers Agent Date: Fri, 10 Jul 2026 07:09:22 +0000 Subject: [PATCH 1/2] fix(leak-scan): replace --all with --log-opts=--all for gitleaks v8.x gitleaks v8.x removed the standalone --all flag; full history scan now requires --log-opts="--all". Fixes the 'unknown flag: --all' error observed in the first all-refs dispatch after the install fix landed. Update the T-D2 test to assert --log-opts is present alongside --all (the value passed to log-opts). --- actions/leak-scan/run.sh | 2 +- tests/test_deploy_platform_d.py | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/actions/leak-scan/run.sh b/actions/leak-scan/run.sh index 2ab585f..24bd105 100755 --- a/actions/leak-scan/run.sh +++ b/actions/leak-scan/run.sh @@ -132,7 +132,7 @@ run_all_refs_scan() { if command -v gitleaks >/dev/null 2>&1; then gitleaks detect \ --source=. \ - --all \ + --log-opts="--all" \ --redact \ --report-path=gitleaks-report.json \ 2>&1 || gitleaks_exit=$? diff --git a/tests/test_deploy_platform_d.py b/tests/test_deploy_platform_d.py index 1d73227..ddbf095 100644 --- a/tests/test_deploy_platform_d.py +++ b/tests/test_deploy_platform_d.py @@ -216,10 +216,12 @@ def test_unknown_mode_fails_with_error_code(self) -> None: self.assertIn("E_UNKNOWN_LEAK_SCAN_MODE", result.stderr) def test_all_refs_mode_line_in_script(self) -> None: - """T-D2: all-refs mode runs gitleaks with --all and --redact flags.""" + """T-D2: all-refs mode runs gitleaks with --log-opts=--all and --redact flags.""" script_text = LEAK_SCAN_RUN.read_text(encoding="utf-8") - # Script uses line continuations; check for key flags independently + # Script uses line continuations; check for key flags independently. + # gitleaks v8.x uses --log-opts="--all" (not --all directly). self.assertIn("gitleaks detect", script_text) + self.assertIn("--log-opts", script_text) self.assertIn("--all", script_text) self.assertIn("--redact", script_text) From 9ace7543f45cb97309572995dbf3b0ee289ef890 Mon Sep 17 00:00:00 2001 From: JorisJonkers Agent Date: Fri, 10 Jul 2026 07:11:12 +0000 Subject: [PATCH 2/2] fix(leak-scan): replace --all with --log-opts=--all for gitleaks v8.x gitleaks v8.x removed the standalone --all flag; full history scan now requires --log-opts="--all". Fixes the 'unknown flag: --all' error observed in the first all-refs dispatch after the install fix landed. Update the T-D2 test to assert the combined --log-opts="--all" form and add a regression guard asserting the bare --all flag is absent. --- tests/test_deploy_platform_d.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/tests/test_deploy_platform_d.py b/tests/test_deploy_platform_d.py index ddbf095..bd1543e 100644 --- a/tests/test_deploy_platform_d.py +++ b/tests/test_deploy_platform_d.py @@ -218,12 +218,17 @@ def test_unknown_mode_fails_with_error_code(self) -> None: def test_all_refs_mode_line_in_script(self) -> None: """T-D2: all-refs mode runs gitleaks with --log-opts=--all and --redact flags.""" script_text = LEAK_SCAN_RUN.read_text(encoding="utf-8") - # Script uses line continuations; check for key flags independently. - # gitleaks v8.x uses --log-opts="--all" (not --all directly). + # gitleaks v8.x uses --log-opts="--all" instead of a standalone --all flag. + # Assert the combined form to catch regression back to the bare --all invocation. self.assertIn("gitleaks detect", script_text) - self.assertIn("--log-opts", script_text) - self.assertIn("--all", script_text) + self.assertIn('--log-opts="--all"', script_text) self.assertIn("--redact", script_text) + # Regression guard: the all-refs block must NOT use a standalone --all flag. + self.assertNotIn( + " --all \\\n", + script_text, + "run.sh must not pass --all as a standalone flag to gitleaks detect (gitleaks v8.x removed it)", + ) def test_path_mode_detects_ipv4_literal(self) -> None: """T-D2: path mode detects IPv4 literal and emits redacted gate-summary."""