From f2665666c6dfd3c0880bab7001dccd7f77afe5a2 Mon Sep 17 00:00:00 2001 From: Ron Gutierrez Date: Wed, 21 Oct 2026 11:42:28 -0400 Subject: [PATCH] Pass patterns to git grep one per line and bump to 1.5.0 git_grep joined every pattern into a single alternation. Apple git's regex engine slows down sharply as one alternation grows: with ~160 patterns (the gitleaks-derived set the Jamf installer is about to deploy), a 20 KB pre-commit scan took over 30 seconds. Feeding the patterns with `git grep -f -` keeps them separate and brings that down to well under a second. regular_grep already passes patterns one per line. Bump the version to 1.5.0 so the Jamf installer can pin a release that includes this fix. Co-Authored-By: Claude Opus 5.5 --- git-secrets | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/git-secrets b/git-secrets index 3340cb1..1a0bb6b 100755 --- a/git-secrets +++ b/git-secrets @@ -11,7 +11,7 @@ # on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either # express or implied. See the License for the specific language governing # permissions and limitations under the License. -VERSION=1.4.1 +VERSION=1.5.0 NONGIT_OK=1 OPTIONS_SPEC="\ git secrets --scan [-r|--recursive] [--cached] [--no-index] [--untracked] [...] @@ -119,10 +119,13 @@ scan_history() { # Note: this function returns 1 on success, 0 on error. git_grep() { local options="$1"; shift - local files=("${@}") combined_patterns=$(load_combined_patterns) + local files=("${@}") patterns=$(load_patterns) - [ -z "${combined_patterns}" ] && return 1 - GREP_OPTIONS= LC_ALL=C git grep -nwHEI ${options} "${combined_patterns}" -- "${files[@]}" + [ -z "${patterns}" ] && return 1 + # Pass patterns one per line rather than as a single alternation: git's + # regex engine slows down sharply as one alternation grows. + printf '%s\n' "${patterns}" \ + | GREP_OPTIONS= LC_ALL=C git grep -nwHEI ${options} -f - -- "${files[@]}" } # Performs a regular grep, taking into account patterns and recursion.