[night-owl] CLI-387 Display detected secret location in git pre-push hook

src/cli/commands/hook/git-pre-push.ts

@@ -22,6 +22,7 @@
 // Replaces the shell logic that was previously embedded in the git hook script.
 
 import { spawnProcess } from '../../../lib/process';
+import { print } from '../../../ui';
 import { CommandFailedError } from '../_common/error';
 import { EXIT_CODE_SECRETS_FOUND, runSecretsBinary } from '../analyze/secrets';
 import type { HookDependencies } from './hook-dependencies';
@@ -54,6 +55,8 @@ async function scanRef(ref: PushRef, emptyTree: string, deps: HookDependencies):
   try {
     const result = await runSecretsBinary(deps.binaryPath, files, deps.auth);
     if ((result.exitCode ?? 1) === EXIT_CODE_SECRETS_FOUND) {
+      const output = [result.stderr, result.stdout].filter(Boolean).join('\n');
+      if (output) print(output);
       throw new CommandFailedError('Secrets detected in pushed commits.', {
         remediationHint:
           'Remove the reported secret, amend the commit if needed, then retry the push.',

tests/integration/specs/hook/hook-git-pre-push.test.ts

@@ -147,6 +147,7 @@ describe('sonar hook git-pre-push', () => {
       });
 
       expect(result.exitCode).toBe(1);
+      expect(result.output).toContain('secret.js');
     },
     { timeout: 30000 },
   );
@@ -189,6 +190,7 @@ describe('sonar hook git-pre-push', () => {
       });
 
       expect(result.exitCode).toBe(1);
+      expect(result.output).toContain('secret.js');
     },
     { timeout: 30000 },
   );