fix: global commit allowlist silently bypassed due to misscoped continue

Start in sources/git.go at the global allowlist loop described in the issue, then trace how each diff file proceeds to commitInfo construction and scanning. Reproduce the case with a commit SHA in a global [[allowlists]] block and run gitleaks git; done means the allowlisted commit produces no findings and is not scanned.

Description

Global [[allowlists]] entries with commits = [...] are silently ignored during gitleaks git scans. The commit is logged as skipped but is fully scanned anyway, producing findings that should be suppressed.

Root Cause

In sources/git.go, the continue statement inside the allowlist loop only advances to the next allowlist entry — it does not skip the outer diff-file processing:

// BEFORE (buggy)
for _, a := range s.Config.Allowlists {
    if ok, c := a.CommitAllowed(gitdiffFile.PatchHeader.SHA); ok {
        logging.Trace().Str("allowed-commit", c).Msg("skipping commit: global allowlist")
        continue  // ← only continues inner for-loop, not the outer select/for
    }
}
// commitInfo build and goroutine launch always happen regardless

After the inner for loop completes, execution falls through unconditionally to build commitInfo and launch the scanning goroutine for every commit — including ones that matched the allowlist.

Steps to Reproduce

1. Create a repo with at least one commit containing a secret
2. Add a global [[allowlists]] block to your config with that commit's SHA:

   [[allowlists]]
   commits = ["<sha-of-commit-with-secret>"]
   

3. Run gitleaks git

Expected: No findings reported (commit is allowlisted)
Actual: Finding is reported; trace log says "skipping commit: global allowlist" but the commit is still scanned

Fix

Use a boolean flag to escape the allowlist loop and then continue the outer loop:

// AFTER (fixed)
commitAllowed := false
for _, a := range s.Config.Allowlists {
    if ok, c := a.CommitAllowed(gitdiffFile.PatchHeader.SHA); ok {
        logging.Trace().Str("allowed-commit", c).Msg("skipping commit: global allowlist")
        commitAllowed = true
        break
    }
}
if commitAllowed {
    continue  // ← correctly skips to next diff file
}

Environment

• Affects all versions of gitleaks that include global [[allowlists]] commit support
• Rule-level [[rules.allowlists]] with commits is not affected (different code path in detect.go)