thoughtworks / talisman

Using a pre-commit hook, Talisman validates the outgoing changeset for things that look suspicious — such as tokens, passwords, and private keys.
https://thoughtworks.github.io/talisman/
MIT License
1.89k stars 241 forks source link

Checksum calculator cmd no longer takes staged changes into account #358

Closed carhartl closed 2 years ago

carhartl commented 2 years ago

Describe the bug After upgrading from v1.11.0 to v1.25.0 it seems the checksum calculator no longer works as documented:

Checksum calculator considers the staged files while calculating the collective checksum of the files.

Staged changes in a file no longer seem to affect the calculation of the checksum; instead it looks like the checksum is always being calculated with the HEAD version of a file in question.

(Or was the change in behavior intentional and documentation overlooked?)

To Reproduce Steps to reproduce the behavior - only after committing, the change in README.md is being reflected in the checksum and changes from db50071255cfd6687a9011c05ef82c985afb25942a6537a839e30e8225445d72:

~/Workspace/talisman-secrets-scan-action main ≡
❯ talisman --version
talisman 1.25.0

~/Workspace/talisman-secrets-scan-action main ≡
❯ cat .talismanrc
fileignoreconfig:
- filename: README.md
  checksum: db50071255cfd6687a9011c05ef82c985afb25942a6537a839e30e8225445d72

~/Workspace/talisman-secrets-scan-action main ≡
❯ g diff

~/Workspace/talisman-secrets-scan-action main ≡
❯ talisman -c README.md

.talismanrc format for given file names / patterns
fileignoreconfig:
- filename: README.md
  checksum: db50071255cfd6687a9011c05ef82c985afb25942a6537a839e30e8225445d72
version: "1.0"
Talisman done in 24.870833ms

~/Workspace/talisman-secrets-scan-action main ≡
❯ g stash pop
On branch main
Your branch is up to date with 'origin/main'.

Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
        modified:   README.md

no changes added to commit (use "git add" and/or "git commit -a")
Dropped refs/stash@{0} (e07a85219e1413df81247193d120bb0de5eb0e75)

~/Workspace/talisman-secrets-scan-action main*
❯ g diff
diff --git a/README.md b/README.md
index 5d54130..236e317 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ This action uses [Talisman](https://thoughtworks.github.io/talisman/) to scan th
 \```yml
 steps:
   - name: Detect secrets with Talisman in incoming commits
-    uses: carhartl/talisman-secrets-scan-action@v1.0.1
+    uses: carhartl/talisman-secrets-scan-action@v1.1.0
 \```

 ## Caveat

~/Workspace/talisman-secrets-scan-action main*
❯ talisman -c README.md

.talismanrc format for given file names / patterns
fileignoreconfig:
- filename: README.md
  checksum: db50071255cfd6687a9011c05ef82c985afb25942a6537a839e30e8225445d72
version: "1.0"
Talisman done in 28.828667ms

~/Workspace/talisman-secrets-scan-action main*
❯ g add README.md

~/Workspace/talisman-secrets-scan-action main*
❯ g status
On branch main
Your branch is up to date with 'origin/main'.

Changes to be committed:
  (use "git restore --staged <file>..." to unstage)
        modified:   README.md

~/Workspace/talisman-secrets-scan-action main*
❯ talisman -c README.md

.talismanrc format for given file names / patterns
fileignoreconfig:
- filename: README.md
  checksum: db50071255cfd6687a9011c05ef82c985afb25942a6537a839e30e8225445d72
version: "1.0"
Talisman done in 32.471875ms

~/Workspace/talisman-secrets-scan-action main*
❯ g commit -m "Test"
[main bdcf58f] Test
 1 file changed, 1 insertion(+), 1 deletion(-)

~/Workspace/talisman-secrets-scan-action main ⇡
❯ talisman -c README.md

.talismanrc format for given file names / patterns
fileignoreconfig:
- filename: README.md
  checksum: bb56483eaa0ba28959b1366e11ba78b0c93ecb5f632ea9256487cb40c91b4314
version: "1.0"
Talisman done in 26.338125ms

Expected behavior Checksum is being calculated taking into account staged changes. Scenario: I already know that a change in a particular file will require an update in .talismanrc and want to commit everything in a single pass by calculating the new checksum based on changes beforehand.

Desktop (please complete the following information):

svishwanath-tw commented 2 years ago

The issue is fixed in the latest release. Closing it now.