A recent branch triggered the logic that detects an update to the .secrets.baseline file and subsequently fails the build/test job in the CI system. This is the expected behavior, but the instructions provided to the developer on how to update .secrets.baseline to pass the check could use some improvements.
The goal of this ticket is to make the following improvements to the instructions in .ci/scripts/util/secrets_scan_compare.sh:
[x] Add an additional line after line 27 with the appropriate command to run: detect-secrets scan --all-files --disable-plugin AbsolutePathDetectorExperimental --exclude-files '\.secrets.*' --exclude-files '\.git*' --exclude-files 'test_results' --exclude-files '\.pytest_cache' --exclude-files '\.venv' --exclude-files 'venv' --exclude-files 'dist' --exclude-files 'build' --exclude-files '.*\.egg-info' > .secrets.baseline
[x] Add an additional step after this with the instructions for running the "audit" mode: detect-secrets audit .secrets.baseline. Be sure to add a detail that if a detected "secret" is benign, then "y" should be entered as the answer to "Is this a secret that should be committed to this repository?" to clear up any ambiguity here.
This should hopefully streamline the process a bit since we will likely trip this check multiple times as we roll out the ISO XML template updates to each PGE
A recent branch triggered the logic that detects an update to the .secrets.baseline file and subsequently fails the build/test job in the CI system. This is the expected behavior, but the instructions provided to the developer on how to update .secrets.baseline to pass the check could use some improvements.
The goal of this ticket is to make the following improvements to the instructions in
.ci/scripts/util/secrets_scan_compare.sh:detect-secrets scan --all-files --disable-plugin AbsolutePathDetectorExperimental --exclude-files '\.secrets.*' --exclude-files '\.git*' --exclude-files 'test_results' --exclude-files '\.pytest_cache' --exclude-files '\.venv' --exclude-files 'venv' --exclude-files 'dist' --exclude-files 'build' --exclude-files '.*\.egg-info' > .secrets.baselinedetect-secrets audit .secrets.baseline. Be sure to add a detail that if a detected "secret" is benign, then "y" should be entered as the answer to "Is this a secret that should be committed to this repository?" to clear up any ambiguity here.This should hopefully streamline the process a bit since we will likely trip this check multiple times as we roll out the ISO XML template updates to each PGE