enh(secu): manage invalid-revision range error

[sc979]

Description

What are your needs or what are you planning to do in this PR?

enh(secu): manage invalid-revision range error

Resolves the "Invalid revision range" failures on the gitleaks job by resolving the
scan range defensively (retry + re-fetch), narrows the scan so it only covers commits
that actually belong to the change under test, and makes the build fail only on a
real secret finding so the alert isn't raised on tooling errors.

Scan-range behavior

compute_range() picks the git log range gitleaks scans (--log-opts), with an
empty value meaning a full-history scan.

• pull_request → merge-base(base, head)..head — only the PR's own commits.
• push, existing branch → before..after — only the commits the push added.
• push, new branch / empty before / rewritten history → merge-base(origin/<default>, after)..after
  — only the commits unique to this branch since it diverged from the default branch.
  The shared base history is already scanned on the default branch's own pushes, so
  re-scanning it here would just re-report pre-existing, unrelated findings.
• fallbacks (default branch not resolvable, unrelated history, other events) →
  full scan. Over-scan is the safe direction — no path silently scans nothing.

New-branch fix: previously a new branch fell back to a full scan, which
re-flagged secrets already living in the default branch's history (not introduced
by the branch). The empty-before case now follows the same path as a real
new branch, so it is consistent and no longer reports unrelated secrets.

Build outcome & alerting

The alert is wired to the build failure, so the job fails only when it must:

gitleaks result	Job outcome	Alert
No secrets (exit 0)	✅ success	—
Secrets found (exit 2)	❌ fail (exit 1)	🔔 raised
Unexpected tool error (any other exit)	✅ success (exit 0) + ::error:: log	—
Range unresolvable after all retries	❌ fail (exit 1)	🔔 raised (transient — re-run the job)

A gitleaks tool/internal error no longer fails the build, so it can't raise a
false alert; it is still surfaced as an ::error:: annotation for visibility. Only a
genuine secret finding (or an unrecoverable range after every retry) fails the job.
The range-resolved log is displayed in the logs

compute_range() test coverage

Verified verbatim against a throwaway repo mimicking the runner layout (default
branch present as refs/remotes/origin/<default>, detached HEAD). Each case asserts
the resulting --log-opts (empty = full scan) and the return code.

A -- B -- C          refs/remotes/origin/main  (default)
      \
       D -- E         pushed branch tip
 \
  F -- G              branch forked off an OLD main commit (A)

X -- Y                unrelated history (no common ancestor)

push — existing branch

Scenario	Mocked env	--log-opts	rc
Existing branch (old tip present)	PUSH_BEFORE=A, PUSH_AFTER=C	--no-merges A..C	0

push — new branch / empty / rewritten → unique commits only

Scenario	Mocked env	--log-opts	rc
New branch off main	PUSH_BEFORE=0000…, PUSH_AFTER=E	--no-merges B..E	0
Empty before (now consistent)	PUSH_BEFORE="", PUSH_AFTER=E	--no-merges B..E	0
Force-push / rewritten (old tip absent)	PUSH_BEFORE=<missing>, PUSH_AFTER=E	--no-merges B..E	0
Branch forked off an old main commit	PUSH_BEFORE=0000…, PUSH_AFTER=G	--no-merges A..G	0

push — fail-safe fallbacks (must be full scan, never empty)

Scenario	Mocked env	--log-opts	rc
Default branch ref missing	DEFAULT_BRANCH=does-not-exist	full scan	0
Unrelated history (no merge-base)	PUSH_AFTER=Y	full scan	0
Branch == default tip (nothing new)	PUSH_AFTER=C	--no-merges C..C (empty range, correct)	0

pull_request

Scenario	Mocked env	--log-opts	rc
Normal PR	HEAD_SHA=E, PR_BASE_SHA=C	--no-merges --first-parent B..E	0
Head missing (force-push race)	HEAD_SHA=<missing>	empty	1 → triggers refetch loop

other events → full scan

Scenario	--log-opts	rc
workflow_dispatch	full scan	0
schedule (cron)	full scan	0

Result: 12 / 12 passed.

Scope: covers the pure range-selection logic (git-only, no gitleaks binary needed).
Does not exercise the refetch retry loop or the gitleaks invocation itself.