safegit v0.26.0 /internal/scan
Updated
On this page

Package scan iterates all git objects (reachable and unreachable) and matches patterns against their textual content for history scrubbing.

#internal/scan

#internal/scan

Package scan iterates all git objects (reachable and unreachable) and matches patterns against their textual content for history scrubbing. Blobs, commit messages, and tag annotations are searched. Binary blobs (NUL in first 8KB) are skipped.

#Match

Go go
type Match struct

Match records a single pattern hit inside a git object.

#ScanResults

Go go
type ScanResults struct

ScanResults holds the aggregate output of a scan across all git objects.

#ScanOpts

Go go
type ScanOpts struct

ScanOpts configures which objects to scan and where to find them.

#AddAttribution

Go go
func AddAttribution(ctx context.Context, results *ScanResults, opts ScanOpts) error

AddAttribution enriches blob matches with commit and path information. For each match where ObjectType "blob" and Path "", it finds which commit(s) contain the blob and what file path it has. Uses git rev-list --all --objects to build a blob-to-path index. Unreachable blobs (not in rev-list output) keep empty Path/CommitSHA. When opts.GitDir is set, commands target that git directory.

#ScanNonObjects

Go go
func ScanNonObjects(ctx context.Context, pattern *regexp.Regexp, gitDir string) ([]Match, error)

ScanNonObjects scans non-git-object files for the given pattern. It checks: - /config (may contain tokens in remote URLs) - /hooks/* (hook scripts, excluding .sample files) - /COMMIT_EDITMSG (last commit message edited) - Working tree files (listed via git ls-files)

Binary files are skipped (NUL in first 8KB). Non-existent files are skipped.

#ScanObjectsMulti

Go go
func ScanObjectsMulti(ctx context.Context, patterns []*regexp.Regexp, opts ScanOpts) ([]*ScanResults, error)

ScanObjectsMulti iterates every object in the git object store once and searches for matches against multiple patterns simultaneously. Returns one ScanResults per pattern (same order as input). The reachable set and object iteration happen only once regardless of how many patterns are provided. Uses the same opts as ScanObjects; only EntireHistory mode is supported.

#ScanObjects

Go go
func ScanObjects(ctx context.Context, pattern *regexp.Regexp, opts ScanOpts) (*ScanResults, error)

ScanObjects iterates git objects and searches for pattern matches. The opts parameter controls which objects are scanned: - EntireHistory=true: uses cat-file --batch-all-objects (all objects including unreachable loose objects). Builds a reachable set to mark each match. - FromSHA set (EntireHistory=false): uses rev-list --objects FromSHA..HEAD (reachable only). All matches are marked reachable by construction. - Both empty/false: returns an error.

When GitDir is set, commands target that git directory instead of CWD. SubmodulePath is set on every returned Match.

Search