1 files changed, 54 insertions, 1 deletions
diff --git a/scripts/tests/pre-commit-secret-scan.bats b/scripts/tests/pre-commit-secret-scan.bats
index 013129e..4647556 100644
--- a/scripts/tests/pre-commit-secret-scan.bats
+++ b/scripts/tests/pre-commit-secret-scan.bats
@@ -14,7 +14,13 @@
 # random base64 blob matched. Measured at ~6% of 100KB blobs; case-sensitive
 # matching drops it to 0 across ~10MB.
 
-VARIANTS="elisp bash go"
+# Discovered, never enumerated. This list read "elisp bash go" while python and
+# typescript also shipped pre-commit hooks, so every "in every variant" test
+# below silently skipped two bundles from the day they were added — the same
+# enumerate-instead-of-discover failure these tests exist to catch. A new bundle
+# is now covered the moment it has a hook.
+VARIANTS="$(cd "${BATS_TEST_DIRNAME}/../../languages" && \
+  for d in */githooks/pre-commit; do [ -f "$d" ] && printf '%s ' "${d%%/*}"; done)"
 
 setup() {
   REPO="$(mktemp -d)"
@@ -142,3 +148,50 @@ run_hook() {
     [ "$status" -eq 0 ] || { echo "$v blocked a removal: $output"; return 1; }
   done
 }
+
+# ---- Fail-closed: a broken git must never read as "nothing to scan" ----
+
+# Put a stub `git` ahead of the real one that fails only the staged-diff call
+# and delegates everything else, so just the pipeline under test breaks.
+break_git() {
+  mkdir -p "$REPO/bin"
+  cat > "$REPO/bin/git" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "diff" ] && [ "${2:-}" = "--cached" ]; then
+  echo "simulated git failure" >&2
+  exit 128
+fi
+exec /usr/bin/git "$@"
+STUB
+  chmod +x "$REPO/bin/git"
+}
+
+@test "secret-scan: a broken git refuses rather than passing blind, in every variant" {
+  # The scan built its input as `git diff ... | grep ... || true`. With no
+  # pipefail, a git failure yielded an empty string, so the scan searched
+  # nothing, found nothing, and reported clean with a real secret staged.
+  # Found by .emacs.d in elisp 2026-07-24; all five variants had it.
+  stage 'aws_key = "AKIAIOSFODNN7EXAMPLE"'
+  break_git
+  for v in $VARIANTS; do
+    run env PATH="$REPO/bin:$PATH" bash \
+      "${BATS_TEST_DIRNAME}/../../languages/$v/githooks/pre-commit"
+    [ "$status" -ne 0 ] || {
+      echo "$v FAILED OPEN: exited 0 with a secret staged and git broken"
+      return 1
+    }
+  done
+}
+
+@test "secret-scan: the refusal says why, in every variant" {
+  stage 'aws_key = "AKIAIOSFODNN7EXAMPLE"'
+  break_git
+  for v in $VARIANTS; do
+    run env PATH="$REPO/bin:$PATH" bash \
+      "${BATS_TEST_DIRNAME}/../../languages/$v/githooks/pre-commit"
+    [[ "$output" == *"cannot read"* ]] || {
+      echo "$v refused without naming the cause: $output"
+      return 1
+    }
+  done
+}