Add secrets scan into build pipeline (+ precommit hook config) - Githubissues

nasa / opera-sds-pge

Observational Products for End-Users from Remote Sensing Analysis (OPERA)

Apache License 2.0

16 stars 6 forks source link

Add secrets scan into build pipeline (+ precommit hook config) #481

Closed RKuttruff closed 3 months ago

RKuttruff commented 3 months ago

Description

This PR adds a secrets detection step to the build/test pipeline, such that builds will fail and alert should a potential secret be found in the code.
Also added is a configuration for a precommit hook that users can configure locally as a safeguard against committing potentially sensitive info.

Affected Issues

474

Testing

Added new stage to build/test
Tested in sandbox:
- Verified clean code is passed
- Added stage to inject a file with secret-like text into working tree and verified it was detected and build failed accordingly

RKuttruff commented 3 months ago

@collinss-jpl Requested changes have been added. I have yet to fully test that they function as intended. Will rerun test where I inject a file to simulate leaked secrets. ETA: Test ran successfully