Secret push protection fails with "invalid revision or path" error during tree traversal

Sentry error: https://new-sentry.gitlab.net/organizations/gitlab/issues/1950491

GRPC::NotFound: 5:invalid revision or path.
  from grpc/generic/active_call.rb:29:in `check_status'
  from grpc/generic/active_call.rb:189:in `attach_status_results_and_complete_call'
  from grpc/generic/active_call.rb:174:in `receive_and_check_status'
  from grpc/generic/active_call.rb:344:in `each_remote_read_then_finish'
  from config/initializers/enumerator_next_patch.rb:11:in `block (2 levels) in <module:EnumeratorNextPatch>'
  from lib/gitlab/gitaly_client/call.rb:46:in `block (3 levels) in instrument_stream'
  from lib/gitlab/gitaly_client/call.rb:61:in `recording_request'
  from lib/gitlab/gitaly_client/call.rb:46:in `block (2 levels) in instrument_stream'
  from lib/gitlab/gitaly_client/call.rb:45:in `loop'
  from lib/gitlab/gitaly_client/call.rb:45:in `block in instrument_stream'
  from lib/gitlab/gitaly_client/commit_service.rb:127:in `each'
  from lib/gitlab/gitaly_client/commit_service.rb:127:in `each'
  from lib/gitlab/gitaly_client/commit_service.rb:127:in `flat_map'
  from lib/gitlab/gitaly_client/commit_service.rb:127:in `tree_entries'
  from lib/gitlab/git/tree.rb:27:in `block in tree_entries'
  from lib/gitlab/git/wraps_gitaly_errors.rb:7:in `wrapped_gitaly_errors'
  from lib/gitlab/git/tree.rb:26:in `tree_entries'
  from gitlab/checks/secret_push_protection/response_handler.rb:123:in `block in transform_findings'
  from gitlab/checks/secret_push_protection/response_handler.rb:120:in `each'
  from gitlab/checks/secret_push_protection/response_handler.rb:120:in `transform_findings'
  from gitlab/checks/secret_push_protection/response_handler.rb:40:in `format_response'
  from gitlab/checks/secret_push_protection/secrets_check.rb:102:in `block in run_validation!'
  from lib/gitlab/checks/timed_logger.rb:27:in `log_timed'
  from gitlab/checks/secret_push_protection/secrets_check.rb:71:in `run_validation!'
  from gitlab/checks/secret_push_protection/secrets_check.rb:21:in `validate!'
  from ee/gitlab/checks/changes_access.rb:15:in `bulk_access_checks!'
  from lib/gitlab/checks/changes_access.rb:30:in `block in validate!'
  from lib/gitlab/checks/timed_logger.rb:27:in `log_timed'
  from lib/gitlab/checks/changes_access.rb:29:in `validate!'
  from lib/gitlab/git_access.rb:391:in `check_access!'
  from lib/gitlab/git_access.rb:378:in `check_change_access!'
  from ee/gitlab/git_access.rb:111:in `check_change_access!'
  from lib/gitlab/git_access.rb:359:in `check_push_access!'
  from lib/gitlab/git_access.rb:96:in `check'
  from ee/gitlab/git_access.rb:22:in `check'

Problem

Users are encountering a GRPC::NotFound: 5:invalid revision or path exception during Git push operations when secret push protection validation is running. The error occurs during tree traversal in the Gitaly commit service.

Error Details

GRPC::NotFound: 5:invalid revision or path.

Stack Trace: The error originates from:

  1. lib/gitlab/gitaly_client/commit_service.rb:127 in tree_entries
  2. gitlab/checks/secret_push_protection/response_handler.rb:123 in transform_findings
  3. gitlab/checks/secret_push_protection/secrets_check.rb:102 during validation
  4. Ultimately called from lib/gitlab/git_access.rb during push access checks

Expected Behavior

Secret push protection should gracefully handle missing or invalid references without blocking the entire push operation.

Edited by 🤖 GitLab Bot 🤖