From cbba8fd773e5c317456f0ad7324f9f66ca0fba67 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 3 Jun 2026 21:10:25 +0000
Subject: [PATCH] CLI-387 Display detected secret location in git pre-push hook

Print the secrets binary output (file path and location) before
throwing the error when secrets are detected during a push, matching
the existing behavior of the pre-commit hook.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/cli/commands/hook/git-pre-push.ts                  | 3 +++
 tests/integration/specs/hook/hook-git-pre-push.test.ts | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/src/cli/commands/hook/git-pre-push.ts b/src/cli/commands/hook/git-pre-push.ts
index 5239e82aa..bb4d7e6d3 100644
--- a/src/cli/commands/hook/git-pre-push.ts
+++ b/src/cli/commands/hook/git-pre-push.ts
@@ -22,6 +22,7 @@
 // Replaces the shell logic that was previously embedded in the git hook script.
 
 import { spawnProcess } from '../../../lib/process';
+import { print } from '../../../ui';
 import { CommandFailedError } from '../_common/error';
 import { EXIT_CODE_SECRETS_FOUND, runSecretsBinary } from '../analyze/secrets';
 import type { HookDependencies } from './hook-dependencies';
@@ -54,6 +55,8 @@ async function scanRef(ref: PushRef, emptyTree: string, deps: HookDependencies):
   try {
     const result = await runSecretsBinary(deps.binaryPath, files, deps.auth);
     if ((result.exitCode ?? 1) === EXIT_CODE_SECRETS_FOUND) {
+      const output = [result.stderr, result.stdout].filter(Boolean).join('\n');
+      if (output) print(output);
       throw new CommandFailedError('Secrets detected in pushed commits.', {
         remediationHint:
           'Remove the reported secret, amend the commit if needed, then retry the push.',
diff --git a/tests/integration/specs/hook/hook-git-pre-push.test.ts b/tests/integration/specs/hook/hook-git-pre-push.test.ts
index 48e106b82..322e84164 100644
--- a/tests/integration/specs/hook/hook-git-pre-push.test.ts
+++ b/tests/integration/specs/hook/hook-git-pre-push.test.ts
@@ -147,6 +147,7 @@ describe('sonar hook git-pre-push', () => {
       });
 
       expect(result.exitCode).toBe(1);
+      expect(result.output).toContain('secret.js');
     },
     { timeout: 30000 },
   );
@@ -189,6 +190,7 @@ describe('sonar hook git-pre-push', () => {
       });
 
       expect(result.exitCode).toBe(1);
+      expect(result.output).toContain('secret.js');
     },
     { timeout: 30000 },
   );