From 1cd1911ac2244f281aef8e2a741dc6a5129de29e Mon Sep 17 00:00:00 2001 From: garrytan Date: Sat, 3 Oct 2026 20:40:39 +0000 Subject: [PATCH] H #2915: cover chunked scanning of large multi-file push diffs Test-only coverage for behavior already on main: a clean two-file pushed diff over the engine's 1 MiB cap passes without engine.input_too_large, and a credential at the end of the second file (a later scan chunk) still blocks the push. Co-authored-by: pneumorea-ai --- test/redact-prepush-hook.test.ts | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/test/redact-prepush-hook.test.ts b/test/redact-prepush-hook.test.ts index f0cb450ac..247d16694 100644 --- a/test/redact-prepush-hook.test.ts +++ b/test/redact-prepush-hook.test.ts @@ -118,6 +118,32 @@ describe("pre-push hook gating", () => { const RELEASE = ["1", "84", "1", "0"].join("."); const PUBLIC_IP = ["8", "8", "8", "8"].join("."); +describe("pushed diffs larger than the engine cap are scanned in chunks (#2915)", () => { + const commitLarge = (tail: string): { base: string; head: string } => { + const base = git(["rev-parse", "HEAD"]); + fs.writeFileSync(path.join(repo, "large-a.txt"), "clean-a ".repeat(90_000)); + fs.writeFileSync(path.join(repo, "large-b.txt"), "clean-b ".repeat(90_000) + tail); + git(["add", "large-a.txt", "large-b.txt"]); + git(["commit", "-q", "-m", "large diff"]); + return { base, head: git(["rev-parse", "HEAD"]) }; + }; + + test("a clean two-file diff over the cap passes without input_too_large", () => { + const { base, head } = commitLarge(""); + const { code, stderr } = runHook(`refs/heads/main ${head} refs/heads/main ${base}\n`); + expect(code).toBe(0); + expect(stderr).not.toContain("engine.input_too_large"); + }); + + test("a credential in a later file's chunk still blocks", () => { + const { base, head } = commitLarge("\n" + FAKE_AWS_KEY + "\n"); + const { code, stderr } = runHook(`refs/heads/main ${head} refs/heads/main ${base}\n`); + expect(code).toBe(1); + expect(stderr).toContain("aws.access_key"); + expect(stderr).not.toContain("engine.input_too_large"); + }); +}); + describe("release version exemption (#2856)", () => { const mediums = (stderr: string): number => Number(/(\d+) MEDIUM finding/.exec(stderr)?.[1] ?? 0); const commitAll = (files: Record, msg: string): string => {