Scanning commits limited to a merge request

[Prateek-Thakare]

Hi all,
While going through the gitleaks code I came to know that it uses git log and log-opts are appended to the same command. I have a requirement where I need to scan commits only for a merge request and ignore all.
For this I have gathered the hashes related to a merge request and I am sending following as the log-opts value:
'-{number_of_commits_in_merge_request} first_commit_sha_of_merge_request last_commit_sha_of_merge_request'

My gitleaks command looks like this:
gitleaks detect --log-opts '-{number_of_commits_in_merge_request} first_commit_sha_of_merge_request last_commit_sha_of_merge_request'

When I run the gitleaks detect scan the number of commits scanned are mostly less than the number_of_commits_in_merge_request

Can anyone please help me if the output is expected or do I need to make some changes.

Thanks
Prateek

[ggjulio]

Hi maybe this could help:

• https://megalinter.io/latest/descriptors/repository_gitleaks/
• https://github.com/oxsecurity/megalinter/blob/main/megalinter/linters/GitleaksLinter.py#L21

They achieved what you want to do, but it only works on some platforms.
It may be possible to do the same using some shell script.
As they say in the first link:

git rev-list -n 1 refs/remotes/origin/<source_branch>
git rev-parse refs/remotes/origin/<target_branch>

The questions is how to retrieve the target & sources branches during the execution of the pipeline.

[Teodoriku]

I think the best way to scan only MR commits is to use gitleaks like this, scanning only commits that are in a branch, and not in the other one yet:

gitleaks detect --log-opts="--left-only origin/source_branch...origin/master"