fix(scripts): git-secrets detectors use \s, a literal s under BSD regex, so macOS misses spaced assignments #329
Description
The password, api-key and secret-key detectors in scripts/setup-git-secrets.sh use \s for whitespace.
git-secrets scans with git grep -E, and POSIX ERE has no \s. Under Apple git's BSD regex the escape degrades to a literal s, so the pattern only matches when a literal s sits where whitespace was intended.
Measured on macOS: an assignment written with a space before the equals sign scans clean, while the same assignment with no space around the equals sign is caught. The detectors work by accident on the no-space form and miss the spaced form entirely. Contributors on Linux get different behaviour from contributors on macOS, from the same script.
The same problem exists in the \s inside upstream git-secrets' own --register-aws patterns, which is out of our control but worth knowing when reading scan results.
Fix shape
Use the POSIX class:
[[:space:]]*
LeanerCloud/cloud-commitments-cli#1972 already applies this reasoning to the PEM detector it rewrites; these three lines were left alone to keep that PR scoped.
Found while measuring for LeanerCloud/cloud-commitments-cli#1972.
Activity
IAmJSD commentedon Oct 15, 2026
Released: this turned out to be already fixed on main (details below), so I'm not working on it.
IAmJSD commentedon Oct 15, 2026
Already fixed: 539778d ("fix(scripts): whole-line anchor the PEM allowlist entry, fix \s under git grep", merged via #101 on 2026-09-28) replaced
\swith[[:space:]]in the three detectors inscripts/setup-git-secrets.shand added a spaced-password fixture toscripts/test-git-secrets-allowlist.sh. #101 didn't mention this issue, so it stayed open. Checked on macOS (Apple git 2.50.1): the old pattern missespassword = "...", the current one catches it; on Linux git/GNU grep both match. The allowlist test passes 42/42 on main and fails 4 with the old\slines restored.@cristim could you close this one?
IAmJSD commentedon Oct 16, 2026
Closing as fixed by 539778d (#101). The evidence is in my comment above:
scripts/setup-git-secrets.shnow uses[[:space:]], and the allowlist test passes 42/42 on main but fails with the old\spatterns restored.