Skip to content

Conversation

eddiez9
Copy link
Contributor

@eddiez9 eddiez9 commented Jun 23, 2022

Problem
I'd like to alert off newly added secrets using detect-secrets-hook and a baseline file in a pipeline job.

Currently using the following command results in pretty printed text. This is difficult to parse programattically.

git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline

ERROR: Potential secrets about to be committed to git repo!

Secret Type: Secret Keyword
Location:    src/blah/appsettings.Development.json:41

Possible mitigations:
  - For information about putting your secrets in a safer place, please ask in
    #security
  - Mark false positives with an inline `pragma: allowlist secret`
    comment

Solution
Added a command line argument to print the newsecrets output as JSON the same way the baseline files are made so I can parse it for the results object.

git ls-files -z | detect-secrets-hook --json --baseline .secrets.baseline

...
"results": {
    "src/blah/appsettings.Development.json": [
      {
        "type": "Secret Keyword",
        "filename": "src/blah/appsettings.Development.json",
        "hashed_secret": "7fa361e59adef2ea0b8571032025a433f926124a",
        "is_verified": false,
        "line_number": 41
      }
    ]
  },
...

@eddiez9
Copy link
Contributor Author

eddiez9 commented Jun 26, 2022

Hey there, requesting any feedback on this PR
@lorenzodb1 @jpdakran

@jpdakran
Copy link
Member

Thanks for your contribution. LGTM 👍 . Can you update this section of the README with the new argument? https://github.com/Yelp/detect-secrets#blocking-secrets-not-in-baseline Thanks!

@eddiez9
Copy link
Contributor Author

eddiez9 commented Jun 27, 2022

Thanks!

Have updated the readme with the new argument

Copy link
Member

@jpdakran jpdakran left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍 Thank you for your contribution.

@jpdakran jpdakran merged commit 22a5c6a into Yelp:master Jun 28, 2022
@jpdakran
Copy link
Member

I forgot to ask. Do you mind adding some unit tests for this? @eddiez9

@eddiez9
Copy link
Contributor Author

eddiez9 commented Jun 29, 2022

Was going to add some but I see you've already done so!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants