darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2025-12-10 23:32:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1744 from GSA/add-detect-secrets-docs

Browse Source 
Add detect-secrets documentation
This commit is contained in:
ccostino
2025-05-30 11:50:14 -04:00
committed by GitHub
parent c301513caf 0a28b33e99
commit cbe50a1aa7
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -477,6 +477,8 @@ instructions above for more details.
- [Onboarding](./docs/all.md#onboarding)
- [Setting up the infrastructure](./docs/all.md#setting-up-the-infrastructure)
- [Using the logs](./docs/all.md#using-the-logs)
- [`git` hooks](./docs/all.md#git-hooks)
- [detect-secrets pre-commit plugin](./docs/all.md#detect-secrets-pre-commit-plugin)
- [Testing](./docs/all.md#testing)
- [CI testing](./docs/all.md#ci-testing)
- [Manual testing](./docs/all.md#manual-testing)

12
docs/all.md
View File

@@ -7,6 +7,7 @@
- [Setting up the infrastructure](#setting-up-the-infrastructure)
- [Using the logs](#using-the-logs)
- [`git` hooks](#git-hooks)
- [detect-secrets pre-commit plugin](#detect-secrets-pre-commit-plugin)
- [Testing](#testing)
- [CI testing](#ci-testing)
- [Manual testing](#manual-testing)
@@ -262,6 +263,17 @@ The configuration is stored in `.pre-commit-config.yaml`. In that config, there
We do not maintain any hooks in this repository.
## detect-secrets pre-commit plugin
One of the pre-commit hooks we use is [`detect-secrets`](https://github.com/Yelp/detect-secrets), which checks for all sorts of things that might be committed accidently that should not be. The project is already set up with a baseline file (`.ds.baseline`) and this should just work out of the box, but occasionally it will flag something new when you try and commit something; or, the file may need a refresh after a while. In either case, to get things back on track and update the `.ds.baseline` file, run these two commands:
```sh
detect-secrets scan --baseline .ds.baseline
detect-secrets audit .ds.baseline
```
The second command will walk you through all of the new detected secrets and ask you to validate if they actually are or if they're false positives. Mark off each one as apppropriate (they should all be false positives - if they're not please stop and check in with the team!), then commit the updates to the `.ds.baseline` file and push them remotely so the project stays up-to-date.
# Testing
```