python-gitleaks-config-regex

Answer

Root cause. gitreins init (gitreins/cli.py::_generate_gitleaks_config) emitted allowlist paths as bare globs (*.log, *.egg-info/, *.spec.md, *.md) into .gitleaks.toml. gitleaks v8.30.1 compiles every [allowlist] paths entry as a Go/RE2 regexp, so *.log (a * with nothing to repeat) panics at config load — panic: regexp: Compile(*.log): error parsing regexp: missing argument to repetition operator — exit 2, on every run, permanently failing the secrets guard on fresh installs.

Fix 1 — _glob_to_regex() in gitreins/cli.py (glob → RE2: only * becomes .*, every other metachar . + ( ) [ ] { } ^ $ | \ ? is escaped literal), and the config generator emits escaped forms:

_GLOB_REGEX_METACHARS = frozenset(".+()[]{}^$|\\?")

def _glob_to_regex(glob: str) -> str:
    """Convert a glob pattern to a RE2-compatible regular expression.

    Gitleaks compiles every allowlist ``paths`` entry as a Go regexp (RE2).
    Bare globs like ``*.log`` yield an invalid regexp (a ``*`` with nothing
    to repeat) and make gitleaks v8.30.x panic with exit 2, permanently
    failing the secrets guard on fresh installs.
    """
    out: list[str] = []
    for ch in glob:
        if ch == "*":
            out.append(".*")
        elif ch in _GLOB_REGEX_METACHARS:
            out.append("\\" + ch)
        else:
            out.append(ch)
    return "".join(out)

In _generate_gitleaks_config, the emission loop becomes:

for p in paths:
    # gitleaks compiles paths as RE2 regexes; escape globs so a fresh
    # install doesn't ship a config that panics gitleaks (exit 2).
    lines.append(f"  '''{_glob_to_regex(p)}''',")

Resulting .gitleaks.toml: '''.*\.log''', '''.*\.egg-info/''', '''.*\.spec\.md''', '''.*\.md''', '''\.git/''', '''apps/.*/node_modules/''', plain dirs unchanged ('''node_modules/'''), and docs//specs/ semantics preserved.

Fix 2 — guard fallback in engine/guard_manager.py::_check_secrets. Fallback to the built-in scanner now happens only on FileNotFoundError (binary absent). A non-zero gitleaks exit is not a Python exception — it must fail the guard, so a panicking gitleaks (exit 2) blocks the commit instead of silently passing via the built-in scanner:

try:
    ...
    result = subprocess.run(cmd, capture_output=True, text=True,
                            timeout=30, cwd=self.workdir, errors='replace')
except FileNotFoundError:
    # ONLY sanctioned fallback: gitleaks binary not installed at all.
    logger.debug("gitleaks not found — using built-in scanner")
    return self._builtin_secrets_scan()
except Exception as e:  # noqa: BLE001 - fail-closed, never silent fallback
    logger.error("gitleaks crashed unexpectedly: %s", e)
    return GuardResult(name="secrets", passed=False, output=f"gitleaks crashed: {e}")

if result.returncode == 0:
    return GuardResult(name="secrets", passed=True, output="gitleaks: clean")
# Non-zero exit (panic exit 2, or real findings exit 1) FAILS the guard.
return GuardResult(name="secrets", passed=False, output=result.stdout + result.stderr)