diff --git a/src/cli/commands/hook/git-pre-push.ts b/src/cli/commands/hook/git-pre-push.ts index 5239e82aa..bb4d7e6d3 100644 --- a/src/cli/commands/hook/git-pre-push.ts +++ b/src/cli/commands/hook/git-pre-push.ts @@ -22,6 +22,7 @@ // Replaces the shell logic that was previously embedded in the git hook script. import { spawnProcess } from '../../../lib/process'; +import { print } from '../../../ui'; import { CommandFailedError } from '../_common/error'; import { EXIT_CODE_SECRETS_FOUND, runSecretsBinary } from '../analyze/secrets'; import type { HookDependencies } from './hook-dependencies'; @@ -54,6 +55,8 @@ async function scanRef(ref: PushRef, emptyTree: string, deps: HookDependencies): try { const result = await runSecretsBinary(deps.binaryPath, files, deps.auth); if ((result.exitCode ?? 1) === EXIT_CODE_SECRETS_FOUND) { + const output = [result.stderr, result.stdout].filter(Boolean).join('\n'); + if (output) print(output); throw new CommandFailedError('Secrets detected in pushed commits.', { remediationHint: 'Remove the reported secret, amend the commit if needed, then retry the push.', diff --git a/tests/integration/specs/hook/hook-git-pre-push.test.ts b/tests/integration/specs/hook/hook-git-pre-push.test.ts index 48e106b82..322e84164 100644 --- a/tests/integration/specs/hook/hook-git-pre-push.test.ts +++ b/tests/integration/specs/hook/hook-git-pre-push.test.ts @@ -147,6 +147,7 @@ describe('sonar hook git-pre-push', () => { }); expect(result.exitCode).toBe(1); + expect(result.output).toContain('secret.js'); }, { timeout: 30000 }, ); @@ -189,6 +190,7 @@ describe('sonar hook git-pre-push', () => { }); expect(result.exitCode).toBe(1); + expect(result.output).toContain('secret.js'); }, { timeout: 30000 }, );