Detect-Secrets.md

# Secrets detection example

Parameters

Argument	Description
-s	Scans the current directory
-e value	Entropy threshold (allowed randomness); Default value 4

Detects secrets in the current project

• One 'analysis' stage with one job
• Allows the job to fail without impacting the rest of the CI (allow_failure: true)

stages:
  - analysis 
variables:
  stage: analysis
  tags:
    - docker
  script:
    - docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/detect-secrets -s -e 4.5
  allow_failure: true

Inline Allowlisting

To tell detect-secrets to ignore a particular line of code, simply append an inline pragma: allowlist secret comment. For example:

API_KEY = "blah-blah-but-actually-not-secret"  # pragma: allowlist secret  
print('hello world')  

Inline commenting syntax for a multitude of languages is supported:

Comment Style	Language Support
#	e.g. Python, Dockerfile, YAML
//	e.g. Go, C++, Java
/* */	e.g. C, Java
'	e.g. Visual Basic .NET
--	e.g. SQL, Haskell
<!-- --!>	e.g. XML

This may be a convenient way for you to allowlist secrets, without having to regenerate the entire baseline again. Furthermore, this makes the allowlisted secrets easily searchable, auditable, and maintainable.

source