Document all git fetch scenarios
What does this MR do and why?
Updates the Pipeline Secret Detection documentation to explain how the analyzer fetches commits and clarify the relationship between GIT_DEPTH and scanning behavior.
📝 Documentation changes
New sections added:
- "How the analyzer fetches commits" - Explains automatic fetching strategies for MRs, custom log options, and historic scans
- "Fallback behavior" - Documents what happens when fetching fails
-
"Initial repository clone depth" - Clarifies
GIT_DEPTHrelationship
Updated troubleshooting:
- "Couldn't run the gitleaks command: exit status 2" - Simplified explanation with clear solutions
- "Adjusting GIT_DEPTH doesn't change what gets scanned" - New entry with examples showing correct vs incorrect configuration
- "Force push detection" - Documents expected behavior after force pushes
- "Repository trust configuration" - Explains safe.directory messages
Why is this needed?
Users frequently misunderstand:
- That
GIT_DEPTHonly affects the runner's initial clone, not what gets scanned - How the analyzer handles missing commits
- What the various log messages mean
This documentation helps users understand the analyzer's behavior and troubleshoot issues more effectively.
Edited by Aditya Tiwari