Skip to content

Conversation

@DelfinSR
Copy link

@DelfinSR DelfinSR commented Feb 5, 2025

A new functionality has been added to rosemary to search for secrets.

$ rosemary detect_secrets --help
Usage: rosemary detect_secrets [OPTIONS] [SPECIFIED_PATH]

  Runs detect-secrets to check if there are any plaintext secret in the source
  code. By default it only checks tracked files.

Options:
  --all_files        Scans all files.
  --baseline         Use baseline file
  --add_to_baseline  Adds all detected secrets to baseline file to don't show
                     them as secrets.
  --help             Show this message and exit.

This new functionality can be used to create a pre-commit hook that avoids to commit secrets.

#!/bin/bash
rosemary detect_secrets --all_files --baseline > /dev/null

 if [ $? -eq 1 ]
 then
    echo "You can't commit yet. You may be leaking secrets...run 'rosemary detect_secrets --all_files --add_to_baseline' before continuing"
    exit 1
 fi

A tutorial on how to use this new functionality can be found at this link (you have to scroll a little bit till this line)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant