Closed varaamo closed 2 years ago
Talisman does not use the .talismanrc in the scan mode. It is used for the pre-hook mode.
This is mentioneded here. : "Talisman currently does not support ignoring of files for scanning".
Note sure if that's accurate. I'm running the following command: ./talisman_linux_amd64 --scan with contents of .talismanrc as follows. It's picking the custom patterns correctly but not the scopeconfig.
scopeconfig:
@varaamo : Scan with ignores was a special build created a long time ago for your usage. The mainline scan feature does not support ignores or custom and allowed patterns. The key problem being a way to identify a particular version of the file that is also easy for users to specify (blob-id vs commit/tag + file path vs what other options).
@svishwanath-tw: Is there a way you can build me a version of a scan with scopeconfig and custom_patterns. We are using a pre-receive secrets scanning hook that I built at my work place using the version of talisman cli you'd provided me earlier. Currently there is a need to ignore package-lock.json and other manifest files from the scans due to the false positives. Much appreciated if you can help.
@varaamo : Please check using release v1.27.0 and close this issue if it suits you.
@varaamo : I'm closing this issue now. Please consider open-sourcing the pre-receive script. I think others would find it useful.
Adding the following lines to .talismanrc doesn't seem to ignore the package-lock.json file. I added these lines and ran talisman --scan and it still reports the integrity fields as potential issues
scopeconfig: