diff --git a/README.md b/README.md index 7ad8b23a0c86d3b2b9fcd974431a49b563444090..901c0c02ae9170187416eefa8fbb1be7a151408b 100644 --- a/README.md +++ b/README.md @@ -27,4 +27,4 @@ This file is automatically updated after execute `git commit` based on the conte - its-registry.unl.edu/unl-its/docker-ci/static-code-analysis:python - _Last update: Thu May 30 17:47:26 CDT 2019_ + _Last update: Thu May 30 17:57:56 CDT 2019_ diff --git a/examples/Detect-Secrets.md b/examples/Detect-Secrets.md index 42057ba55024a39460234f92cf354f545439600c..e11457e486f6001ffa040569612e7bc719de0e52 100644 --- a/examples/Detect-Secrets.md +++ b/examples/Detect-Secrets.md @@ -1,4 +1,4 @@ -# Secrets detection example + # Secrets detection example ## Parameters @@ -22,3 +22,23 @@ variables: script: - docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/detect-secrets -s -e 4.5 ``` + +# Inline Allowlisting +To tell detect-secrets to ignore a particular line of code, simply append an inline pragma: allowlist secret comment. For example: + +API_KEY = "blah-blah-but-actually-not-secret" # pragma: allowlist secret +print('hello world') +Inline commenting syntax for a multitude of languages is supported: + +| Comment Style | Language Support | +| :------------ | :-------------- | +|# | e.g. Python, Dockerfile, YAML | +|// | e.g. Go, C++, Java | +|/* */ | e.g. C, Java | +|' | e.g. Visual Basic .NET | +| -- | e.g. SQL, Haskell | +| <!-- --!> | e.g. XML | + +This may be a convenient way for you to allowlist secrets, without having to regenerate the entire baseline again. Furthermore, this makes the allowlisted secrets easily searchable, auditable, and maintainable. + +_[source](https://github.com/Yelp/detect-secrets#secrets-baseline)_