diff --git a/test/redact-prepush-hook.test.ts b/test/redact-prepush-hook.test.ts index f0cb450ac..247d16694 100644 --- a/test/redact-prepush-hook.test.ts +++ b/test/redact-prepush-hook.test.ts @@ -118,6 +118,32 @@ describe("pre-push hook gating", () => { const RELEASE = ["1", "84", "1", "0"].join("."); const PUBLIC_IP = ["8", "8", "8", "8"].join("."); +describe("pushed diffs larger than the engine cap are scanned in chunks (#2915)", () => { + const commitLarge = (tail: string): { base: string; head: string } => { + const base = git(["rev-parse", "HEAD"]); + fs.writeFileSync(path.join(repo, "large-a.txt"), "clean-a ".repeat(90_000)); + fs.writeFileSync(path.join(repo, "large-b.txt"), "clean-b ".repeat(90_000) + tail); + git(["add", "large-a.txt", "large-b.txt"]); + git(["commit", "-q", "-m", "large diff"]); + return { base, head: git(["rev-parse", "HEAD"]) }; + }; + + test("a clean two-file diff over the cap passes without input_too_large", () => { + const { base, head } = commitLarge(""); + const { code, stderr } = runHook(`refs/heads/main ${head} refs/heads/main ${base}\n`); + expect(code).toBe(0); + expect(stderr).not.toContain("engine.input_too_large"); + }); + + test("a credential in a later file's chunk still blocks", () => { + const { base, head } = commitLarge("\n" + FAKE_AWS_KEY + "\n"); + const { code, stderr } = runHook(`refs/heads/main ${head} refs/heads/main ${base}\n`); + expect(code).toBe(1); + expect(stderr).toContain("aws.access_key"); + expect(stderr).not.toContain("engine.input_too_large"); + }); +}); + describe("release version exemption (#2856)", () => { const mediums = (stderr: string): number => Number(/(\d+) MEDIUM finding/.exec(stderr)?.[1] ?? 0); const commitAll = (files: Record, msg: string): string => {