Expected Behavior
The suggested command for pre-commit hooks should scan staged data before it's actually committed:
#!/bin/sh
trufflehog git file://. --since-commit HEAD --results=verified,unknown --fail
Actual Behavior
The TruffleHog output shows no data scanned ("bytes": 0). When you add the --trust-local-git-config it will work properly. Seems (partially?) related to #4553.
Steps to Reproduce
- Follow the steps to add a global git hook.
- Add a canary token to a new file. Commit it.
- The commit won't be blocked and you'll see no data scanned.
- Update the pre-commit file with
--trust-local-git-config . Repeat step 2. It should catch it and block.
Environment
- OS: OSX
- TruffleHog v3.91.1
Additional Context
The --trust-local-git-config flag was added in #4502
CC'ing @jaydee-th