filesToScan selects staged files with git diff --cached --name-only --diff-filter=ACM (index.js:275). That filter covers Added/Copied/Modified but excludes renames (R).
Impact: git mv .env config.txt && git add config.txt stages a file that may carry real secrets, but envoy --check will not scan it — a gap in the staged-file safety gate.
Proposed fix: include R (e.g. --diff-filter=ACMR) and resolve the rename target path. Add a test that stages a renamed secret-bearing file and asserts it is flagged.
Surfaced during test-suite hardening for the --check feature (#14 / #24).
filesToScanselects staged files withgit diff --cached --name-only --diff-filter=ACM(index.js:275). That filter covers Added/Copied/Modified but excludes renames (R).Impact:
git mv .env config.txt && git add config.txtstages a file that may carry real secrets, butenvoy --checkwill not scan it — a gap in the staged-file safety gate.Proposed fix: include
R(e.g.--diff-filter=ACMR) and resolve the rename target path. Add a test that stages a renamed secret-bearing file and asserts it is flagged.Surfaced during test-suite hardening for the
--checkfeature (#14 / #24).