Module continuous_delivery_scripts.detect_secrets

Check tracked files against the project's recorded secret registry.

Functions

def detect_secrets(baseline_file: pathlib.Path | None = None) ‑> None

Expand source code

def detect_secrets(baseline_file: Optional[Path] = None) -> None:
    """Check tracked files so new secrets are not introduced."""
    git = ProjectGitWrapper()
    project_root = Path(str(git.root))
    resolved_baseline = _get_secrets_baseline_file(baseline_file)
    tracked_files = _filter_tracked_files(git.list_tracked_files(), project_root, resolved_baseline)
    if not tracked_files:
        logger.info("No tracked files found for detect-secrets.")
        return
    subprocess.check_call(
        _generate_detect_secrets_hook_command_list(resolved_baseline, _determine_exclude_files(), tracked_files),
        cwd=str(project_root),
    )

Check tracked files so new secrets are not introduced.

def main() ‑> int

Expand source code

def main() -> int:
    """Script CLI."""
    parser = argparse.ArgumentParser(
        description=(
            "Check tracked files against the recorded secret registry so new secrets are not committed. "
            "This uses Yelp detect-secrets (https://github.com/Yelp/detect-secrets)."
        )
    )
    parser.add_argument(
        "-r",
        "--registry-file",
        default=Path(_get_secrets_baseline_filename()),
        help="Secret registry file to use.",
        type=Path,
    )
    parser.add_argument(
        "-v",
        "--verbose",
        action="count",
        default=0,
        help="Verbosity, by default errors are reported.",
    )
    args = parser.parse_args()
    set_log_level(args.verbose)

    try:
        detect_secrets(args.registry_file)
        return 0
    except Exception as e:
        log_exception(logger, e)
        return 1

Script CLI.