lirantal / docker-detect-secrets Goto Github PK

View Code? Open in Web Editor NEW

5.0 3.0 4.0 20 KB

A docker image for Yelp's docker-secrets python application

License: Apache License 2.0

Dockerfile 100.00%

git secrets docker detect-secrets

docker-detect-secrets's Introduction

About

A docker image to enable invoking of Yelp's detect-secrets hook command without having to install the python package.

This image is deployed to Docker Hub at: https://hub.docker.com/r/lirantal/detect-secrets

Usage

Detecting secrets in a project

Runs the detect-secrets-hook command for a given git project, with the following options:

The current directory is assumed to be the .git root directory and so the volume mounts pwd to the container's /usr/src/app directory
src/index.js and src/component.js are files for which will be tested for secrets

docker run -it --rm --name detect-secrets --volume `pwd`:/usr/src/app lirantal/detect-secrets "src/index.js" "src/component.js"

Detecting secrets in a project that has a baseline

If a project has a previously created .secrets-baseline it can be passed as a command argument to the container:

docker run -it --rm --name detect-secrets --volume `pwd`:/usr/src/app lirantal/detect-secrets "--baseline .secrets-baseline" "src/index.js"

Detecting secrets in a monorepo style project

For projects which exhibit a structure such as:

| app
  |_ .git/
  |_ client/
  |_ server/
       |_ .secrets-baseline

it is required to tweak the execution of detect-secrets-hook when it runs in the container image to simulate the exact scenario of it running inside the nested server/ directory, while mounting the top level application directory:

docker run -it --rm --name detect-secrets --volume /path/to/root/project/dir:/usr/src/app --workdir "/usr/src/app/server" lirantal/detect-secrets "src/index.js"

Developing

Building the image from the Dockerfile and then you may execute it locally:

docker build --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') --tag detect-secrets .

Author

Liran Tal [email protected]

docker-detect-secrets's People

Contributors

Stargazers

Watchers

Forkers

belaaiza peakon ubaidbaig-10p

docker-detect-secrets's Issues

Update detect-secrets

I am having issues with ignoring yarn v2 lock files and I want to use --exclude-files feature.

   ✔ eslint .
      ✖ detect-secrets-launcher --baseline .secrets-baseline --exclude-files *.lock
        git add



✖ detect-secrets-launcher --baseline .secrets-baseline --exclude-files *.lock found some errors. Please fix them and try committing again.


usage: detect-secrets-hook [-h] [-v] [--version] [--baseline BASELINE]
                         [--exclude-lines EXCLUDE_LINES]
                         [--word-list WORD_LIST_FILE] [--use-all-plugins]
                         [-n] [--base64-limit [BASE64_LIMIT]]
                         [--hex-limit [HEX_LIMIT]] [--no-private-key-scan]
                         [--no-softlayer-scan] [--no-aws-key-scan]
                         [--no-basic-auth-scan] [--no-slack-scan]
                         [--no-keyword-scan] [--no-artifactory-scan]
                         [--no-stripe-scan] [--no-jwt-scan]
                         [--no-mailchimp-scan] [--no-base64-string-scan]
                         [--no-hex-string-scan]
                         [--keyword-exclude KEYWORD_EXCLUDE]
                         [filenames [filenames ...]]
detect-secrets-hook: error: unrecognized arguments: --exclude-files
husky > pre-commit hook failed (add --no-verify to bypass)

https://github.com/Yelp/detect-secrets/blob/master/CHANGELOG.md#tada-new-features

Can we update to v1? I'm not sure whether I can actually do something from my side.

pip is not installing latest version of detect-secrets

If I run the image with /bin/bash as entrypoint and run detect-secrets --version, it shows the version 1.0.3, which is not the latest version of detect-secrets.

The pip install detect-secrets command should install the latest version.

To add some information:
When I run pip list -o, pip recognizes the package as outdated:

Install pyahocorasick to allow the use of --word-list flag

The Yelp's detect-secrets tool allow the use of --word-list flag to pass a file with words to be ignored, but this flag requires the installation of pyahocorasick, which could be done by:

pip install detect-secrets[word_list]

My suggestion is to replace the current pip install with the one above, allowing people to use the --word-list flag.

Specifying a specific version of detect-secrets

Thanks for the great work,

I saw this package and want to utilize this
https://hub.docker.com/r/lirantal/detect-secrets/tags

As I can see in the docker hub, the available tag is latest main and nightly

It will be super if version could be specified

Upgrade docker box to use the latest Yelp detect-secrets

The docker box is running on .12.4

$ detect-secrets --version
0.12.4

Could we rebuild and repush the image to use version 0.13?

Run docker-detect-secrets in the root of a project using Husky.

Hello there. I've been trying to implement this solution in my project using Husky but I'm having a hard time with the setup.

I know the readme says:

The current directory is assumed to be the .git root directory

But can the current directory be something different?

This is the structure of my project:

project
│   .secrets.baseline
│
└───.husky
│   │   pre-commit
│   │   commit-msg
│   
└───frontend
│   │   somefile1.js
│   │   somefile2.ts
│   │   ...
│   
└───backend
    │   somefile3.js
    │   somefile4.js

What I have in my pre-commit file is this:

#!/usr/bin/env sh
. "$(dirname -- "$0")/_/husky.sh"

npx lint-staged
docker run -it --rm --name detect-secrets --volume `pwd`:/usr/src/app lirantal/detect-secrets "*"

The npx lint-staged line is working fine but the second one:

docker run -it --rm --name detect-secrets --volume `pwd`:/usr/src/app lirantal/detect-secrets "*"

Is giving me this output:

[scan]  INFO    Skipping "*" due to `detect_secrets.filters.common.is_invalid_file`

I also tested passing a full path and also a relative path but same result:

docker run -it --rm --name detect-secrets --volume `pwd`:/usr/src/app lirantal/detect-secrets "frontend/somefile1.js"

[scan]  INFO    Skipping "frontend/somefile1.js" due to `detect_secrets.filters.common.is_invalid_file`

What am I doing wrong?

Can this project structure have this working?

I would really appreciate the help.

Versions:

Husky: 8.0.0
Docker Desktop 4.9.1