gitwise-cli 0.30.0__tar.gz → 0.31.0__tar.gz

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/CHANGELOG.md

@@ -3,6 +3,12 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.31.0 (2026-06-19)
+
+### Feat
+
+- **secret-scan**: commit-time guard and diff --scan-secrets (Sprint 2 D3) (#68)
+
 ## v0.30.0 (2026-06-19)
 
 ### Feat

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitwise-cli
-Version: 0.30.0
+Version: 0.31.0
 Summary: Python CLI for optimizing git workflows and Claude Code integration
 Project-URL: Homepage, https://github.com/drzioner/gitwise
 Project-URL: Repository, https://github.com/drzioner/gitwise

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/gitwise/__init__.py

@@ -1,6 +1,6 @@
 """gitwise -- CLI for optimizing git workflows and coding-agent integration."""
 
-__version__ = "0.30.0"
+__version__ = "0.31.0"
 
 
 def get_version() -> str:

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/gitwise/_cli_dispatch.py

@@ -193,6 +193,7 @@ def _run_diff(args: argparse.Namespace) -> int:
         name_only=args.name_only,
         full=args.full,
         summary=args.summary,
+        scan_secrets=args.scan_secrets,
         as_json=args.json,
     )
 
@@ -232,6 +233,7 @@ def _run_commit(args: argparse.Namespace) -> int:
         breaking=args.breaking,
         amend=args.amend,
         dry_run=args.dry_run,
+        allow_secret=args.allow_secret,
         as_json=args.json,
     )
 

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/gitwise/_cli_parser.py

@@ -184,6 +184,11 @@ def build_parser() -> argparse.ArgumentParser:
         help="compact summary: additions/deletions per file, no patch",
     )
     p.add_argument("--stat", action="store_true", help="show diffstat (default behavior)")
+    p.add_argument(
+        "--scan-secrets",
+        action="store_true",
+        help="scan the diff for leaked credentials (advisory, opt-in)",
+    )
     p.add_argument(
         "refspec",
         nargs="?",
@@ -218,6 +223,11 @@ def build_parser() -> argparse.ArgumentParser:
     p.add_argument("--breaking", action="store_true", help="breaking change (!)")
     p.add_argument("--amend", action="store_true", help="amend last commit")
     p.add_argument("--dry-run", action="store_true", help="show without committing")
+    p.add_argument(
+        "--allow-secret",
+        action="store_true",
+        help="proceed past a high-severity secret finding (with confirmation)",
+    )
 
     p = sub.add_parser("branches", help="branch intelligence dashboard", parents=[parent])
     p.add_argument("--stale", action="store_true", help="show stale [gone] branches only")

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/gitwise/_i18n_data.json

@@ -463,6 +463,38 @@
     "es": "demasiados argumentos posicionales antes de '--' ({count}); gitwise diff acepta un unico refspec (usa a..b para un rango)",
     "en": "too many positional arguments before '--' ({count}); gitwise diff accepts a single refspec (use a..b for a range)"
   },
+  "secret_scan_clean": {
+    "es": "no se detectaron secretos en el diff",
+    "en": "no secrets detected in the diff"
+  },
+  "secret_scan_found": {
+    "es": "{rule} en {path}:{line} ({preview})",
+    "en": "{rule} at {path}:{line} ({preview})"
+  },
+  "secret_scan_found_header": {
+    "es": "Secretos detectados -- {count} hallazgo(s):",
+    "en": "Secrets detected -- {count} finding(s):"
+  },
+  "secret_scan_blocked_high": {
+    "es": "commit bloqueado: {count} secreto(s) de alta severidad en el área de staging",
+    "en": "commit blocked: {count} high-severity secret(s) in the staging area"
+  },
+  "secret_scan_blocked_hint": {
+    "es": "revoque o rote el secreto, remuévalo del stage, o use --allow-secret (con confirmación) para commitear de todos modos",
+    "en": "revoke/rotate the secret, unstage it, or use --allow-secret (with confirmation) to commit anyway"
+  },
+  "secret_scan_allow_confirm": {
+    "es": "Se detectaron {count} secreto(s) de alta severidad. ¿Commitear de todos modos?",
+    "en": "{count} high-severity secret(s) detected. Commit anyway?"
+  },
+  "secret_scan_medium_warning": {
+    "es": "advertencia: {rule} en {path}:{line} ({preview})",
+    "en": "warning: {rule} at {path}:{line} ({preview})"
+  },
+  "secret_scan_unavailable": {
+    "es": "no se pudo escanear el área de staging (fail-closed): {error}",
+    "en": "could not scan the staging area (fail-closed): {error}"
+  },
   "directory_exists": {
     "es": "el directorio ya existe: {path}",
     "en": "directory already exists: {path}"

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/gitwise/commit.py

@@ -6,9 +6,10 @@ from pathlib import Path
 from .git import PROTECTED_BRANCHES, current_branch, gpg_status, require_root
 from .git import run as git_run
 from .i18n import t
-from .output import error, print_bracket, print_header, print_json
+from .output import confirm, error, print_bracket, print_header, print_json, warn
 from .utils.in_progress import detect_in_progress, in_progress_hint
 from .utils.json_envelope import error_envelope, ok_envelope
+from .utils.secret_scan import SecretScanUnavailable, scan_staged_diff
 
 _CONVENTIONAL_RE = re.compile(
     r"^(feat|fix|refactor|docs|chore|test|style|perf|ci|build|revert)(\(.+\))?!?: .{1,72}"
@@ -110,6 +111,68 @@ def _report_commit_error(*, as_json: bool, err: str) -> int:
     return 1
 
 
+def _enforce_secret_guard(*, root: Path, allow_secret: bool, as_json: bool) -> int | None:
+    """Scan staged content for leaked credentials; return 1 to block, None to proceed.
+
+    Runs by default on every commit. High-severity findings block unless
+    ``allow_secret`` is set (human mode still asks for confirmation); medium
+    findings only warn. The full secret is never printed -- previews are redacted.
+    Fails closed: if the staged diff cannot be read, the commit is blocked
+    rather than allowed through unscanned.
+    """
+    try:
+        findings = scan_staged_diff(root)
+    except SecretScanUnavailable as exc:
+        unavailable = t("secret_scan_unavailable", error=str(exc))
+        if as_json:
+            print_json(error_envelope(error=unavailable, code="secret_scan_unavailable"))
+        else:
+            error(unavailable)
+        return 1
+    if not findings:
+        return None
+    high = [f for f in findings if f["severity"] == "high"]
+    medium = [f for f in findings if f["severity"] == "medium"]
+    for f in medium:
+        warn(
+            t(
+                "secret_scan_medium_warning",
+                rule=f["rule"],
+                path=f["path"],
+                line=str(f["line"]),
+                preview=f["preview"],
+            )
+        )
+    if not high:
+        return None
+    if not allow_secret:
+        if as_json:
+            print_json(
+                error_envelope(
+                    error=t("secret_scan_blocked_high", count=str(len(high))),
+                    code="secret_leak_high",
+                    hint=t("secret_scan_blocked_hint"),
+                    findings=high,
+                )
+            )
+        else:
+            for f in high:
+                error(
+                    t(
+                        "secret_scan_found",
+                        rule=f["rule"],
+                        path=f["path"],
+                        line=str(f["line"]),
+                        preview=f["preview"],
+                    )
+                )
+            error(t("secret_scan_blocked_hint"))
+        return 1
+    if not as_json and not confirm(t("secret_scan_allow_confirm", count=str(len(high)))):
+        return 1
+    return None
+
+
 def run_commit(
     *,
     message: str | None = None,
@@ -118,6 +181,7 @@ def run_commit(
     breaking: bool = False,
     amend: bool = False,
     dry_run: bool = False,
+    allow_secret: bool = False,
     as_json: bool = False,
 ) -> int:
     """Validate a conventional-commit message and create a GPG-signed commit.
@@ -164,6 +228,10 @@ def run_commit(
     if not _validate_gpg_ready(root):
         return 1
 
+    secret_rc = _enforce_secret_guard(root=root, allow_secret=allow_secret, as_json=as_json)
+    if secret_rc is not None:
+        return secret_rc
+
     if dry_run:
         if as_json:
             print_json(ok_envelope(message=full_msg, amend=amend, dry_run=True))

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/gitwise/diff.py

@@ -20,6 +20,7 @@ from .output import (
 )
 from .utils.git_output import parse_name_status_entries, status_label
 from .utils.json_envelope import ok_envelope
+from .utils.secret_scan import secret_scan
 
 DiffValue = str | int | bool
 DiffFileEntry = dict[str, DiffValue]
@@ -414,6 +415,51 @@ def _render_summary_output(
     return 0
 
 
+def _render_secret_scan_output(
+    *, root: Path, refspec: str | None, paths: list[str] | None, as_json: bool
+) -> int:
+    """Scan the diff patch for leaked credentials and report findings (opt-in).
+
+    The diff flags defeat user config that could bypass the scanner
+    (``color.ui=always`` ANSI, external/textconv drivers) -- same reasoning as
+    the commit-time guard in ``_staged_diff_text``.
+    """
+    args = ["--no-pager", "diff", "--no-color", "--no-ext-diff", "--no-textconv"]
+    if refspec:
+        args.append(refspec)
+    else:
+        args.append("HEAD")
+    if paths:
+        args.append("--")
+        args.extend(paths)
+    result = git_run(args, cwd=root, check=False)
+    if result.returncode != 0:
+        error(t("git_diff_failed", error=result.stderr.strip()))
+        return 1
+    findings = secret_scan(result.stdout)
+    if as_json:
+        print_json(ok_envelope(findings=findings, count=len(findings)))
+        return 1 if any(f["severity"] == "high" for f in findings) else 0
+    if not findings:
+        info(t("secret_scan_clean"))
+        return 0
+    print_header(t("secret_scan_found_header", count=str(len(findings))))
+    for f in findings:
+        sev = f["severity"]
+        line = t(
+            "secret_scan_found",
+            rule=f["rule"],
+            path=f["path"],
+            line=str(f["line"]),
+            preview=f["preview"],
+        )
+        if sev == "high":
+            error(line)
+        else:
+            warn(line)
+    return 1 if any(f["severity"] == "high" for f in findings) else 0
+
+
 def run_diff(
     *,
     refspec: str | None = None,
@@ -423,6 +469,7 @@ def run_diff(
     name_only: bool = False,
     full: bool = False,
     summary: bool = False,
+    scan_secrets: bool = False,
     as_json: bool = False,
 ) -> int:
     """Render a diff of changed files, a refspec, or a range.
@@ -447,6 +494,9 @@ def run_diff(
         info(t("no_commits_yet"))
         return 0
 
+    if scan_secrets:
+        return _render_secret_scan_output(root=cwd, refspec=refspec, paths=paths, as_json=as_json)
+
     if summary:
         numstat_details = _numstat_details(cwd, staged=staged, refspec=refspec, paths=paths)
         summary_files = list(numstat_details.values())

gitwise_cli-0.31.0/gitwise/utils/secret_scan.py

@@ -0,0 +1,201 @@
+"""Detect leaked credentials in diffs before they reach the object database.
+
+Scans added lines (`+`, excluding the `+++` header) of a diff for high-signal
+credential patterns. Designed for the commit-time guard (block on high
+severity) and `diff --scan-secrets` (advisory). False-positive avoidance is a
+hard requirement: the ruleset favours prefixed, vendor-documented formats over
+generic "looks like a key" heuristics, so the project's own test corpus scans
+clean.
+
+Verified sources (token formats change over time; the GitHub `ghs_` rule in
+particular was rewritten in 2026 to match the new stateless long-form):
+- GitHub credential prefixes and the 2026 stateless `ghs_APPID_JWT` rollout:
+  github.blog/changelog/2026-04-24-notice-about-upcoming-new-format-for-github-app-installation-tokens
+  and github/docs content/organizations/.../github-credential-types.md
+- Dual `ghs_` regex (legacy 36-char + long-form dotted) ported from
+  github/gh-aw PR #34737 (2026-05-25)
+- GitLab PAT length 27-300: docs.gitlab.com/security/tokens/ via GitLab MR 169322
+- AWS access key id format `AKIA[0-9A-Z]{16}`: docs.aws.amazon.com/IAM/latest/.../reference_identifiers.html
+- OpenSSH new-format magic `b3BlbnNzaC1rZXktdjE` (base64 of "openssh-key-v1"):
+  protSPEC openssh/PROTOCOL.key
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Literal, TypedDict
+
+from ..git import run as git_run
+
+SecretSeverity = Literal["high", "medium"]
+
+_DIFF_ADDED_LINE_RE = re.compile(r"^\+(?!\+\+)")
+_HUNK_HEADER_RE = re.compile(r"^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@")
+
+
+class SecretScanUnavailable(RuntimeError):
+    """Raised when the staged diff cannot be read, so a scan cannot run."""
+
+
+class SecretFinding(TypedDict):
+    """One credential match located in a scanned diff."""
+
+    rule: str
+    path: str
+    line: int
+    preview: str
+    severity: SecretSeverity
+
+
+# Each rule: (compiled pattern, human rule name, severity). Patterns target the
+# credential itself; surrounding assignment context is handled where it raises
+# precision (e.g. AWS secret key).
+_GITHUB_TOKEN_RE = re.compile(
+    r"(?:"
+    r"gh[pou]_[A-Za-z0-9]{36,}"
+    r"|ghr_[A-Za-z0-9]{36,}"
+    r"|ghs_(?:[0-9A-Za-z]{36}(?![0-9A-Za-z._-])|[0-9A-Za-z_-]{10,}(?:\.[0-9A-Za-z_-]{10,}){2,})"
+    r"|github_pat_[A-Za-z0-9_]{80,}"
+    r")"
+)
+
+_RULES: list[tuple[re.Pattern[str], str, SecretSeverity]] = [
+    (re.compile(r"AKIA[0-9A-Z]{16}"), "aws_access_key_id", "high"),
+    (
+        re.compile(r"(?i)aws_secret_access_key['\"]?\s*[:=]\s*['\"]?([A-Za-z0-9/+=]{40})"),
+        "aws_secret_access_key",
+        "high",
+    ),
+    (_GITHUB_TOKEN_RE, "github_token", "high"),
+    (re.compile(r"glpat-[A-Za-z0-9_-]{20,300}"), "gitlab_pat", "high"),
+    (
+        re.compile(r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED |)PRIVATE KEY-----"),
+        "private_key_pem",
+        "high",
+    ),
+    (re.compile(r"b3BlbnNzaC1rZXktdjE[A-Za-z0-9+/=]*"), "openssh_private_key", "high"),
+    (
+        re.compile(
+            r"(?i)(?:api[_-]?key|secret|token|password)['\"]?\s*[:=]\s*['\"]([A-Za-z0-9_\-]{24,})['\"]"
+        ),
+        "generic_secret_assignment",
+        "medium",
+    ),
+]
+
+_PREVIEW_KEEP_PREFIX = 8
+_PREVIEW_KEEP_SUFFIX = 4
+
+
+def _redact(match: str) -> str:
+    """Truncate a credential for display so the full secret is never printed."""
+    if len(match) <= _PREVIEW_KEEP_PREFIX + _PREVIEW_KEEP_SUFFIX:
+        return "***"
+    return f"{match[:_PREVIEW_KEEP_PREFIX]}...{match[-_PREVIEW_KEEP_SUFFIX:]}"
+
+
+def _staged_diff_text(root: Path) -> str:
+    """Return the full cached diff text.
+
+    Raises ``SecretScanUnavailable`` when git itself reports a failure, so the
+    commit guard fails closed (block) instead of silently treating an
+    unscannable index as clean. The diff flags defeat user config that could
+    otherwise bypass the scanner: ``--no-color`` strips ANSI that breaks line
+    parsing, ``--no-ext-diff`` and ``--no-textconv`` ignore external/textconv
+    drivers that could hide added content while still exiting 0.
+    """
+    result = git_run(
+        ["--no-pager", "diff", "--cached", "--no-color", "--no-ext-diff", "--no-textconv"],
+        cwd=root,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise SecretScanUnavailable(result.stderr.strip() or "git diff --cached failed")
+    return result.stdout
+
+
+def _parse_diff_hunk_for_path(line: str) -> str | None:
+    """Return the path from a `+++ <path>` diff header, or None.
+
+    Handles both the default `+++ b/<path>` prefix and the prefixless form a
+    user gets with `diff.noprefix=true`, plus `/dev/null` (file absent on the
+    new side of a delete).
+    """
+    if not line.startswith("+++ "):
+        return None
+    rest = line[4:]
+    if rest == "/dev/null":
+        return None
+    if rest.startswith("b/"):
+        return rest[2:]
+    return rest
+
+
+def secret_scan(diff_text: str) -> list[SecretFinding]:
+    """Scan added lines of a unified diff for credential patterns.
+
+    Only lines introduced by the diff (leading `+`, excluding the `+++` header)
+    are inspected, so pre-existing content is never flagged. Reported line
+    numbers are the true new-file line numbers parsed from each
+    ``@@ -old,+new @@`` hunk header (so a finding points at the exact line to
+    remediate even across multi-hunk or delete-heavy diffs). Each match becomes
+    a ``SecretFinding`` with a redacted preview.
+    """
+    findings: list[SecretFinding] = []
+    current_path = ""
+    line_no = 0
+    for raw in diff_text.splitlines():
+        path_from_header = _parse_diff_hunk_for_path(raw)
+        if path_from_header is not None:
+            current_path = path_from_header
+            line_no = 0
+            continue
+        hunk = _HUNK_HEADER_RE.match(raw)
+        if hunk:
+            # Next context/added line in the new file is +new_start; decrement
+            # so the increment below lands on the right number.
+            line_no = int(hunk.group(1)) - 1
+            continue
+        if raw.startswith("-"):
+            # Removed lines belong to the old file only and do not advance the
+            # new-file line counter.
+            continue
+        if not _DIFF_ADDED_LINE_RE.match(raw):
+            if raw.startswith(" "):
+                line_no += 1
+            continue
+        line_no += 1
+        payload = raw[1:]
+        for pattern, rule, severity in _RULES:
+            for match in pattern.finditer(payload):
+                findings.append(
+                    SecretFinding(
+                        rule=rule,
+                        path=current_path,
+                        line=line_no,
+                        preview=_redact(match.group(0)),
+                        severity=severity,
+                    )
+                )
+    # Suppress the generic rule when a vendor-specific rule already flagged the
+    # same line: "ghp_..." should report github_token (high), not also a noisy
+    # medium generic_secret_assignment on top of it.
+    specific_keys = {
+        (f["path"], f["line"]) for f in findings if f["rule"] != "generic_secret_assignment"
+    }
+    return [
+        f
+        for f in findings
+        if f["rule"] != "generic_secret_assignment" or (f["path"], f["line"]) not in specific_keys
+    ]
+
+
+def scan_staged_diff(root: Path) -> list[SecretFinding]:
+    """Convenience wrapper: scan the index (staged) diff of `root`."""
+    return secret_scan(_staged_diff_text(root))
+
+
+def has_high_severity(findings: list[SecretFinding]) -> bool:
+    """Return True if any finding is high severity (commit-blocking)."""
+    return any(finding["severity"] == "high" for finding in findings)

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gitwise-cli"
-version = "0.30.0"
+version = "0.31.0"
 description = "Python CLI for optimizing git workflows and Claude Code integration"
 readme = "README.md"
 license = "MIT"

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/share/schemas/v1/input/commit.json

@@ -58,6 +58,11 @@
       "type": "boolean",
       "description": "show without committing",
       "default": false
+    },
+    "allow_secret": {
+      "type": "boolean",
+      "description": "proceed past a high-severity secret finding (with confirmation)",
+      "default": false
     }
   }
 }

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/share/schemas/v1/input/diff.json

@@ -57,6 +57,11 @@
       "description": "show diffstat (default behavior)",
       "default": false
     },
+    "scan_secrets": {
+      "type": "boolean",
+      "description": "scan the diff for leaked credentials (advisory, opt-in)",
+      "default": false
+    },
     "refspec": {
       "type": "string",
       "description": "commit, branch, or range to diff (e.g. HEAD~3, main..feat, main...feat)"

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/tests/test_commit.py

@@ -98,3 +98,61 @@ def test_commit_no_duplicate_type(tmp_git_repo: Path) -> None:
     r = run_gitwise("commit", "-m", "feat: already typed", "--dry-run", cwd=tmp_git_repo)
     assert r.returncode == 0
     assert "feat: feat: already typed" not in r.stdout
+
+
+# -- secret-scan guard (D3) ---------------------------------------------------
+# Sample secrets are assembled at runtime from fragments so the test source
+# stays scanner-clean; otherwise the commit guard would flag this file.
+
+
+def _aws_key() -> str:
+    return "AK" + "IAIOSFODNN7EXAMPLE"
+
+
+def test_commit_blocked_on_secret_high(tmp_git_repo: Path) -> None:
+    (tmp_git_repo / "config.py").write_text(f"aws_key = '{_aws_key()}'\n")
+    _git(["add", "config.py"], tmp_git_repo)
+    r = run_gitwise("commit", "-m", "feat: add config", cwd=tmp_git_repo)
+    assert r.returncode == 1
+    assert "secret" in r.stderr.lower() or "blocked" in r.stderr.lower()
+
+
+def test_commit_blocked_on_secret_high_json(tmp_git_repo: Path) -> None:
+    (tmp_git_repo / "config.py").write_text(f"key = '{_aws_key()}'\n")
+    _git(["add", "config.py"], tmp_git_repo)
+    r = run_gitwise("commit", "-m", "feat: add config", "--json", cwd=tmp_git_repo)
+    assert r.returncode == 1
+    import json
+
+    data = json.loads(r.stdout)
+    assert data["errors"][0]["code"] == "secret_leak_high"
+
+
+def test_commit_allow_secret_json_proceeds(tmp_git_repo: Path) -> None:
+    (tmp_git_repo / "config.py").write_text(f"key = '{_aws_key()}'\n")
+    _git(["add", "config.py"], tmp_git_repo)
+    r = run_gitwise(
+        "commit", "-m", "feat: add config", "--allow-secret", "--json", cwd=tmp_git_repo
+    )
+    assert r.returncode == 0
+    # The commit was actually created despite the high-severity finding.
+    log = _git(["--no-pager", "log", "--oneline"], tmp_git_repo).stdout.decode()
+    assert "add config" in log
+
+
+def test_commit_warns_on_secret_medium(tmp_git_repo: Path) -> None:
+    body = "a" * 30
+    (tmp_git_repo / "config.py").write_text(f'api_key = "{body}"\n')
+    _git(["add", "config.py"], tmp_git_repo)
+    r = run_gitwise("commit", "-m", "feat: add config", cwd=tmp_git_repo)
+    assert r.returncode == 0
+    assert "warning" in r.stderr.lower() or "secret" in r.stderr.lower()
+
+
+def test_commit_blocked_on_secret_despite_color_always(tmp_git_repo: Path) -> None:
+    """color.ui=always must not bypass the guard via ANSI-wrapped diff lines."""
+    _git(["config", "color.ui", "always"], tmp_git_repo)
+    (tmp_git_repo / "config.py").write_text(f"key = '{_aws_key()}'\n")
+    _git(["add", "config.py"], tmp_git_repo)
+    r = run_gitwise("commit", "-m", "feat: add config", cwd=tmp_git_repo)
+    assert r.returncode == 1

{gitwise_cli-0.30.0 → gitwise_cli-0.31.0}/tests/test_diff.py

@@ -325,3 +325,27 @@ def test_diff_binary_lfs_warning_json(tmp_git_repo):
     data = json.loads(result.stdout)
     assert "binary_warnings" in data
     assert len(data["binary_warnings"]) >= 1
+
+
+# ── D3: --scan-secrets (opt-in advisory scan) ────────────────────────────────
+
+
+def test_diff_scan_secrets_detects_high(tmp_git_repo):
+    """--scan-secrets flags a staged high-severity credential."""
+    aws = "AK" + "IAIOSFODNN7EXAMPLE"
+    (tmp_git_repo / "config.py").write_text(f"key = '{aws}'\n")
+    _git(["add", "config.py"], tmp_git_repo)
+    result = _run("diff", "--scan-secrets", "--json", cwd=tmp_git_repo)
+    assert result.returncode == 1
+    data = json.loads(result.stdout)
+    assert data["count"] >= 1
+    assert any(f["severity"] == "high" for f in data["findings"])
+
+
+def test_diff_scan_secrets_clean(tmp_git_repo):
+    """--scan-secrets on a clean diff reports no findings and exits 0."""
+    (tmp_git_repo / "README.md").write_text("hello world\n")
+    _git(["add", "README.md"], tmp_git_repo)
+    result = _run("diff", "--scan-secrets", cwd=tmp_git_repo)
+    assert result.returncode == 0
+    assert "no secrets" in result.stdout.lower()