fix(ci): post-fix gitleaks scan false-positives when fix agent merges or rebases main

[ifireball]

What happens

When a fix agent merges or rebases main into a PR branch, the post-fix gitleaks gate can fail even though the agent introduced no secrets. The agent's work is discarded and the branch is not pushed.

Observed on PR #6172:

Workflow run	Agent action	gitleaks result
31944245704	git merge origin/main	70 commits scanned, leaks found: 1
31945204416	git rebase origin/main	75 commits scanned, leaks found: 1

In both cases PRE_AGENT_HEAD was fdbf826 (PR head before the agent ran). The push was blocked by the post-fix script with "Secret scan blocked".

The flagged finding is a false positive from main history:

• Rule: private-key
• Commit on main: 2385e357 — fix(#5221): redact behaviour debug artifacts before upload
• File: .github/scripts/redact-behaviour-artifacts-test.sh
• Content: fake RSA PEM test fixture (MIIEowIBAAKCAQEAfake), not a real credential

File-scoped scan-secrets in the agent sandbox passed. Scanning only the rebased PR commits (HEAD~5..HEAD) also passes.

What should happen

The post-fix gitleaks scan should only inspect commits the fix agent actually authored — not upstream main commits pulled in by merge or rebase.

After a rebase, PRE_AGENT_HEAD is no longer an ancestor of HEAD, so PRE_AGENT_HEAD..HEAD is not a reliable "agent commits only" range.

How to reproduce

PR_HEAD=fdbf82646667b5cef670b2c3b0d90eddc1d4c9c9

# Merge case (~70 commits in range, 1 false positive)
git checkout "$PR_HEAD"
git merge origin/main --no-edit
gitleaks detect --source . --log-opts="${PR_HEAD}..HEAD"

# Rebase case (range explodes — PRE_AGENT_HEAD orphaned)
git checkout "$PR_HEAD"
git rebase origin/main
git merge-base --is-ancestor "$PR_HEAD" HEAD   # false
gitleaks detect --source . --log-opts="${PR_HEAD}..HEAD"

Context

PRE_AGENT_HEAD is recorded in .github/workflows/reusable-fix.yml (git rev-parse HEAD immediately after checkout) and passed to post-fix.sh in the agents repo, which runs:

SCAN_RANGE="${DIFF_BASE}..HEAD"   # DIFF_BASE = PRE_AGENT_HEAD
gitleaks detect --source . --log-opts="${SCAN_RANGE}"

post-fix.sh already documents that PRE_AGENT_HEAD..HEAD breaks after rebase and uses merge-base for BRANCH_CHANGED_FILES / pre-commit scoping — but gitleaks still uses the broken range.

Related issues (same root cause):

• fullsend-ai/agents#318 — proposes merge-base-aware SCAN_RANGE fix in post-fix.sh (covers Signed-off-by and gitleaks)
• fullsend#5419 — audit of rebase-unsafe commit-range checks in post-scripts

PR #6172 remains stuck at fdbf826; neither blocked fix-agent push landed.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 1:27 PM UTC · Completed 1:32 PM UTC

Commit: 7aa8587 · View workflow run →

[fullsend-ai-triage]

This issue is blocked on fullsend-ai/agents#318, which tracks the same root cause: post-fix.sh computes SCAN_RANGE as PRE_AGENT_HEAD..HEAD, which after a rebase or merge includes upstream main commits the fix agent did not author. The fix — switching to a merge-base-aware range — must land in post-fix.sh in the agents repo. No changes to reusable-fix.yml in this repo are needed since post-fix.sh already has access to the git state required to compute the correct range (it already uses merge-base for BRANCH_CHANGED_FILES and pre-commit scoping).

Also related: #5419 tracks a broader audit of rebase-unsafe commit-range checks across post-scripts. Once agents#318 lands, this issue and the gitleaks portion of #5419 should both be resolvable.

Blocked by:

• Post-fix SCAN_RANGE must use merge-base after rebase to prevent Signed-off-by false positives agents#318

---

Labels: This is a CI bug (component/ci) involving the fix agent (agent/fix), blocked on an upstream dependency, at medium priority since it causes false-positive scan failures that block fix-agent pushes but has a known root cause.