GitGuardian / ggshield

Find and fix 400+ types of hardcoded secrets and 70+ types of infrastructure-as-code misconfigurations.
https://gitguardian.com
MIT License
1.65k stars 147 forks source link

Add an option to ignore secrets which are removed by the scanned commit #909

Open Walz opened 3 months ago

Walz commented 3 months ago

Context

Add an option to ignore secrets which are removed by the scanned commit.
The goal of this PR is to create a way to accept secrets which are being remediated. If a dev is removing a secret from their code, but not rewriting the git history, GGShield will prevent them (pre-commit, pre-push or pre-receive) from committing and pushing the secret remediation.

This optional option will allow users to accept secrets in commits when they are removed, either on a deleted line or in a deleted file.

What has been done

Validation

Create a repository, add then remove a secret:

git init
echo "ggtt-v-7faxcu9ak6" > secret.txt
git add secret.txt
git commit -m "add secret"
echo "remove" > secret.txt
git add secret.txt
git commit -m "remove secret"

Then verify that scanning the repository raises two incidents and only one with --ignore-removed-secrets

$ ggshield secret scan repo . --json | jq .total_incidents
Scanning... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 2 / 2
2
$ ggshield secret scan repo . --json --ignore-removed-secrets | jq .total_incidents
Scanning... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 2 / 2
1

PR check list