[BUG] when I pass --branch and not pass --since-commit this tool need me to pass

[amone-bit]

📋 Checklist

• I’m running the latest main or a recent release.
• I’ve searched existing issues and no open issue covers this bug.
• If this is a build problem, I attached the full error log.

---

What version?

1.58.0

🐞 What happened?

when I pass --branch and not pass --since-commit this tool need me to pass

✅ What did you expect to happen?

I want if I dont pass --since-commit, this parameter will be a default value, and scan the whole branch that I passed.

🔢 Reproduction steps

Just use scan subcommand

💻 Environment

Item	Value
OS / Distro	windows 11 25h2
Rust toolchain	rustc --version →
kingfisher ver.	<!-- kingfisher --version OR git rev-parse HEAD OR release tag -->

📎 Log / stack trace

Click to expand

# Paste or drag-and-drop here

[amone-bit]

I dont sure whether this tool can be, what I want is if what I passed the --branch ref is not in the local git repository, I hope kingfisher can first try to git fetch origin <ref> and if this ref dont exists in the remote repository, than return error or do other something.

[mickgmdb]

Kingfisher v1.59.0 has this change.

kingfisher now scans so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch.

Examples:

kingfisher scan ~/tmp/repo --branch feature-123

# Or scan a branch when cloning on the fly
kingfisher scan \
  --git-url https://github.com/org/repo.git \
  --branch origin/feature-123```

[amone-bit]

I tested again, and I encounter a problem: .\kingfisher.exe scan --branch <commit hash> <local repo> this command dont have any findings, but .\kingfisher.exe scan <local repo> this command has findings.What I expected is if I pass the first command, I can scan the local repository's specific branch, but seems have some bug.

[amone-bit]

By the way, I find a bug again, there is a same repo, just use two different command, but has different findings: .\kingfisher.exe scan --git-url https://github.com/dustin-decker/secretsandstuff.git and .\kingfisher.exe scan <local secretsandstuff repo>, what I do is I clone it to local manually, but kingfisher has different results.

[mickgmdb]

Thank you for the feedback. I'll investigate.

[mickgmdb]

To answer your second question, I am updating the README to explain this behavior:

Why does --git-url sometimes report fewer findings than scanning a local checkout?.

Remote clones created via --git-url default to --mirror/bare mode so Kingfisher only reads the Git history. When you point Kingfisher at an existing working tree (for example kingfisher scan ./repo), it enumerates both the filesystem contents and the Git history. Any secrets that are present in the checked-out files therefore appear twice: once from the working tree path and once from the commit where the secret entered the history. To replicate the remote behavior locally, either scan a bare clone or disable history scanning with --git-history none when targeting a working tree.

[amone-bit]

Okay, I understand.

To answer your second question, I am updating the README to explain this behavior:

Why does --git-url sometimes report fewer findings than scanning a local checkout?.
Remote clones created via --git-url default to --mirror/bare mode so Kingfisher only reads the Git history. When you point Kingfisher at an existing working tree (for example kingfisher scan ./repo), it enumerates both the filesystem contents and the Git history. Any secrets that are present in the checked-out files therefore appear twice: once from the working tree path and once from the commit where the secret entered the history. To replicate the remote behavior locally, either scan a bare clone or disable history scanning with --git-history none when targeting a working tree.

[amone-bit]

And this bug, I paste extra info here. I scan this local repo: https://github.com/dustin-decker/secretsandstuff.git.

• this command: .\kingfisher.exe scan --branch 70001020fab32b1fcf2f1f0e5c66424eae649826 <local repo>, the 70001020fab32b1fcf2f1f0e5c66424eae649826 is HEAD, the last commit hash, but has nothing findings.I think this should scan the whole git history, but seem not.
• this command: .\kingfisher.exe scan <local repo> has findings in git history and work dirtectory.

By the way, I noteced that the github,gitlab,azure... command args all in scan subcommand.To be honest, It's a little Chaos to me. Maybe you can move these args to corresponding subcommands like this tool named trufflehog did.It can be more clear.

I tested again, and I encounter a problem: .\kingfisher.exe scan --branch <commit hash> <local repo> this command dont have any findings, but .\kingfisher.exe scan <local repo> this command has findings.What I expected is if I pass the first command, I can scan the local repository's specific branch, but seems have some bug.

[micksmix]

@amone-bit

By the way, I noteced that the github,gitlab,azure... command args all in scan subcommand.To be honest, It's a little Chaos to me.

I agree. I have simplified the syntax via sub commands based on providers in v1.60.0. Please check the updated examples in the README file.

The direct branch scanning should also work as you expect now:

cd /tmp
git clone https://github.com/micksmix/SecretsTest.git

cd /tmp/SecretsTest
git checkout feature-1
#
# scan diff between main and feature-1 branch
kingfisher scan /tmp/SecretsTest --branch feature-1 \
  --since-commit=$(git -C /tmp/SecretsTest merge-base main feature-1)
#
# scan only a specific commit
kingfisher scan /tmp/dev/SecretsTest \
  --branch baba6ccb453963d3f6136d1ace843e48d7007c3f

[amone-bit]

scan only a specific commit

kingfisher scan /tmp/dev/SecretsTest
--branch baba6ccb453963d3f6136d1ace843e48d7007c3f

Maybe you misunderstand what I mean is. This command I want the kingfisher scan the whole tree with this commit as its root

[amone-bit]

@micksmix

scan diff between main and feature-1 branch

kingfisher scan /tmp/SecretsTest --branch feature-1
--since-commit=$(git -C /tmp/SecretsTest merge-base main feature-1)

I have a question. Will these two commit: feature-1 and $(git -C /tmp/SecretsTest merge-base main feature-1) be included in the scanning process. When I use this command: kingfisher scan .\SecretsTest\ --branch feature-1 --since-commit=feature-1that has no findings.