Skip to content

Commit ac2378c

Browse files
YCShen1010YCShen1010
authored
Enable detect secrets in SPS build pipelines (#1201)
* Add .secrets.baseline file to track sensitive info detection results Signed-off-by: Sophie Shen <syc_libra@live.cn> * Enable detect-secrets step in CI and PR pipelines Signed-off-by: Sophie Shen <syc_libra@live.cn> * Rename PPC pipeline to PPC64LE and update dependencies in multiarch checks Signed-off-by: Sophie Shen <syc_libra@live.cn> * Remove unnecessary binfmt installation step from prepare-buildx target Signed-off-by: Sophie Shen <syc_libra@live.cn> --------- Signed-off-by: Sophie Shen <syc_libra@live.cn>
1 parent 685dda2 commit ac2378c

File tree

4 files changed

+334
-9
lines changed

4 files changed

+334
-9
lines changed

‎.pipeline-config-ci.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ tasks:
1010
- name: checks-setup
1111
when: 'false'
1212
- name: detect-secrets
13-
when: 'false'
13+
when: 'true'
1414
include:
1515
- docker-socket
1616
- name: compliance-checks

‎.pipeline-config-pr.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ tasks:
1010
- name: checks-setup
1111
when: 'false'
1212
- name: detect-secrets
13-
when: 'false'
13+
when: 'true'
1414
include:
1515
- docker-socket
1616
- name: unit-test
@@ -42,7 +42,7 @@ tasks:
4242
- name: checks-setup
4343
when: 'false'
4444
- name: detect-secrets
45-
when: 'false'
45+
when: 'true'
4646
include:
4747
- docker-socket
4848
- name: unit-test
@@ -74,7 +74,7 @@ tasks:
7474
- name: checks-setup
7575
when: 'false'
7676
- name: detect-secrets
77-
when: 'false'
77+
when: 'true'
7878
include:
7979
- docker-socket
8080
- name: unit-test
@@ -106,7 +106,7 @@ tasks:
106106
- name: checks-setup
107107
when: 'false'
108108
- name: detect-secrets
109-
when: 'false'
109+
when: 'true'
110110
include:
111111
- docker-socket
112112
- name: unit-test
@@ -135,7 +135,7 @@ tasks:
135135
- name: compliance-checks
136136
when: 'false'
137137

138-
pr-code-checks-ppc:
138+
pr-code-checks-ppc64le:
139139
from: pr-code-checks
140140
runtimeClassName: x86-xlarge
141141
include:
@@ -212,15 +212,15 @@ tasks:
212212
runtimeClassName: x86-xlarge
213213
runAfter:
214214
- pr-code-checks-amd64
215-
- pr-code-checks-ppc
215+
- pr-code-checks-ppc64le
216216
- pr-code-checks-s390
217217
include:
218218
- dind
219219
steps:
220220
- name: checks-setup
221221
when: 'false'
222222
- name: detect-secrets
223-
when: 'false'
223+
when: 'true'
224224
include:
225225
- docker-socket
226226
- dind

‎.secrets.baseline‎

Lines changed: 326 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,326 @@
1+
{
2+
"exclude": {
3+
"files": "go.sum|go.mod|^.secrets.baseline$",
4+
"lines": null
5+
},
6+
"generated_at": "2025-11-03T14:28:59Z",
7+
"plugins_used": [
8+
{
9+
"name": "AWSKeyDetector"
10+
},
11+
{
12+
"name": "ArtifactoryDetector"
13+
},
14+
{
15+
"name": "AzureStorageKeyDetector"
16+
},
17+
{
18+
"base64_limit": 4.5,
19+
"name": "Base64HighEntropyString"
20+
},
21+
{
22+
"name": "BasicAuthDetector"
23+
},
24+
{
25+
"name": "BoxDetector"
26+
},
27+
{
28+
"name": "CloudantDetector"
29+
},
30+
{
31+
"ghe_instance": "github.ibm.com",
32+
"name": "GheDetector"
33+
},
34+
{
35+
"name": "GitHubTokenDetector"
36+
},
37+
{
38+
"hex_limit": 3,
39+
"name": "HexHighEntropyString"
40+
},
41+
{
42+
"name": "IbmCloudIamDetector"
43+
},
44+
{
45+
"name": "IbmCosHmacDetector"
46+
},
47+
{
48+
"name": "JwtTokenDetector"
49+
},
50+
{
51+
"keyword_exclude": null,
52+
"name": "KeywordDetector"
53+
},
54+
{
55+
"name": "MailchimpDetector"
56+
},
57+
{
58+
"name": "NpmDetector"
59+
},
60+
{
61+
"name": "PrivateKeyDetector"
62+
},
63+
{
64+
"name": "SlackDetector"
65+
},
66+
{
67+
"name": "SoftlayerDetector"
68+
},
69+
{
70+
"name": "SquareOAuthDetector"
71+
},
72+
{
73+
"name": "StripeDetector"
74+
},
75+
{
76+
"name": "TwilioKeyDetector"
77+
}
78+
],
79+
"results": {
80+
"bundle/manifests/operand-deployment-lifecycle-manager.clusterserviceversion.yaml": [
81+
{
82+
"hashed_secret": "99ddc8a6c519da3e597f5e1d5b82bca2ccdd29d8",
83+
"is_secret": false,
84+
"is_verified": false,
85+
"line_number": 22,
86+
"type": "Secret Keyword",
87+
"verified_result": null
88+
},
89+
{
90+
"hashed_secret": "aaed328dd083d0c3af645661c0d9b5f535a46606",
91+
"is_secret": false,
92+
"is_verified": false,
93+
"line_number": 464,
94+
"type": "Secret Keyword",
95+
"verified_result": null
96+
},
97+
{
98+
"hashed_secret": "b84353fa45588dbbf500039556637290ef292611",
99+
"is_secret": false,
100+
"is_verified": false,
101+
"line_number": 521,
102+
"type": "Secret Keyword",
103+
"verified_result": null
104+
}
105+
],
106+
"common/Makefile.common.mk": [
107+
{
108+
"hashed_secret": "1c9b29b40c7759ef4666dff4065908278fa4c837",
109+
"is_secret": false,
110+
"is_verified": false,
111+
"line_number": 32,
112+
"type": "Secret Keyword",
113+
"verified_result": null
114+
}
115+
],
116+
"config/e2e/manager/manager.yaml": [
117+
{
118+
"hashed_secret": "b9274fd20e965ade322fd1b50fff623eabaa1c3b",
119+
"is_secret": false,
120+
"is_verified": false,
121+
"line_number": 30,
122+
"type": "Hex High Entropy String",
123+
"verified_result": null
124+
}
125+
],
126+
"config/manager/manager.yaml": [
127+
{
128+
"hashed_secret": "b9274fd20e965ade322fd1b50fff623eabaa1c3b",
129+
"is_secret": false,
130+
"is_verified": false,
131+
"line_number": 32,
132+
"type": "Hex High Entropy String",
133+
"verified_result": null
134+
}
135+
],
136+
"config/manifests/bases/operand-deployment-lifecycle-manager.clusterserviceversion.yaml": [
137+
{
138+
"hashed_secret": "aaed328dd083d0c3af645661c0d9b5f535a46606",
139+
"is_secret": false,
140+
"is_verified": false,
141+
"line_number": 353,
142+
"type": "Secret Keyword",
143+
"verified_result": null
144+
},
145+
{
146+
"hashed_secret": "b84353fa45588dbbf500039556637290ef292611",
147+
"is_secret": false,
148+
"is_verified": false,
149+
"line_number": 410,
150+
"type": "Secret Keyword",
151+
"verified_result": null
152+
}
153+
],
154+
"config/samples/operator_v1alpha1_operandbindinfo.yaml": [
155+
{
156+
"hashed_secret": "99ddc8a6c519da3e597f5e1d5b82bca2ccdd29d8",
157+
"is_secret": false,
158+
"is_verified": false,
159+
"line_number": 12,
160+
"type": "Secret Keyword",
161+
"verified_result": null
162+
}
163+
],
164+
"controllers/operandbindinfo/operandbindinfo_controller.go": [
165+
{
166+
"hashed_secret": "0505ee303edffbbcb314426728ca74ac30ad2e71",
167+
"is_secret": false,
168+
"is_verified": false,
169+
"line_number": 312,
170+
"type": "Secret Keyword",
171+
"verified_result": null
172+
}
173+
],
174+
"controllers/operator/manager.go": [
175+
{
176+
"hashed_secret": "0505ee303edffbbcb314426728ca74ac30ad2e71",
177+
"is_secret": false,
178+
"is_verified": false,
179+
"line_number": 1381,
180+
"type": "Secret Keyword",
181+
"verified_result": null
182+
}
183+
],
184+
"controllers/operator/manager_test.go": [
185+
{
186+
"hashed_secret": "fe966f3c91f0d86db520cebd70fad20d31e64396",
187+
"is_secret": false,
188+
"is_verified": false,
189+
"line_number": 1267,
190+
"type": "Secret Keyword",
191+
"verified_result": null
192+
}
193+
],
194+
"controllers/testutil/test_util.go": [
195+
{
196+
"hashed_secret": "3982c799d1c4f3ae3190ad4e09248585c651a946",
197+
"is_secret": false,
198+
"is_verified": false,
199+
"line_number": 243,
200+
"type": "Secret Keyword",
201+
"verified_result": null
202+
},
203+
{
204+
"hashed_secret": "08175ec631c367891f55c615fb8d710a1001362b",
205+
"is_secret": false,
206+
"is_verified": false,
207+
"line_number": 336,
208+
"type": "Secret Keyword",
209+
"verified_result": null
210+
},
211+
{
212+
"hashed_secret": "00cafd126182e8a9e7c01bb2f0dfd00496be724f",
213+
"is_secret": false,
214+
"is_verified": false,
215+
"line_number": 361,
216+
"type": "Secret Keyword",
217+
"verified_result": null
218+
},
219+
{
220+
"hashed_secret": "c636e8e238fd7af97e2e500f8c6f0f4c0bedafb0",
221+
"is_secret": false,
222+
"is_verified": false,
223+
"line_number": 365,
224+
"type": "Secret Keyword",
225+
"verified_result": null
226+
},
227+
{
228+
"hashed_secret": "418ee516f1cb095c50ff2f10a76192889c281f3a",
229+
"is_secret": false,
230+
"is_verified": false,
231+
"line_number": 369,
232+
"type": "Secret Keyword",
233+
"verified_result": null
234+
}
235+
],
236+
"docs/design/operand-deployment-lifecycle-manager.md": [
237+
{
238+
"hashed_secret": "0522bf47d33ac469d10e000b5f9f3a761f7e9d0a",
239+
"is_secret": false,
240+
"is_verified": false,
241+
"line_number": 272,
242+
"type": "Secret Keyword",
243+
"verified_result": null
244+
},
245+
{
246+
"hashed_secret": "aaed328dd083d0c3af645661c0d9b5f535a46606",
247+
"is_secret": false,
248+
"is_verified": false,
249+
"line_number": 517,
250+
"type": "Secret Keyword",
251+
"verified_result": null
252+
},
253+
{
254+
"hashed_secret": "b84353fa45588dbbf500039556637290ef292611",
255+
"is_secret": false,
256+
"is_verified": false,
257+
"line_number": 575,
258+
"type": "Secret Keyword",
259+
"verified_result": null
260+
}
261+
],
262+
"docs/user/how-to-use-operandBindInfo.md": [
263+
{
264+
"hashed_secret": "aa891d4e101044bdd59c2b7ce36a2eb8f3b16793",
265+
"is_secret": false,
266+
"is_verified": false,
267+
"line_number": 73,
268+
"type": "Secret Keyword",
269+
"verified_result": null
270+
}
271+
],
272+
"helm-cluster-scoped/values.yaml": [
273+
{
274+
"hashed_secret": "da5743b16ccee188d5e5c28cea321ce7a041f4cb",
275+
"is_secret": false,
276+
"is_verified": false,
277+
"line_number": 2,
278+
"type": "Secret Keyword",
279+
"verified_result": null
280+
}
281+
],
282+
"helm/templates/operator-deployment.yaml": [
283+
{
284+
"hashed_secret": "99ddc8a6c519da3e597f5e1d5b82bca2ccdd29d8",
285+
"is_secret": false,
286+
"is_verified": false,
287+
"line_number": 47,
288+
"type": "Secret Keyword",
289+
"verified_result": null
290+
}
291+
],
292+
"helm/values.yaml": [
293+
{
294+
"hashed_secret": "da5743b16ccee188d5e5c28cea321ce7a041f4cb",
295+
"is_secret": false,
296+
"is_verified": false,
297+
"line_number": 2,
298+
"type": "Secret Keyword",
299+
"verified_result": null
300+
}
301+
],
302+
"test/e2e/helpers_test.go": [
303+
{
304+
"hashed_secret": "41b89c91ee19ba61572168ab6baba46185084957",
305+
"is_secret": false,
306+
"is_verified": false,
307+
"line_number": 683,
308+
"type": "Secret Keyword",
309+
"verified_result": null
310+
},
311+
{
312+
"hashed_secret": "99ddc8a6c519da3e597f5e1d5b82bca2ccdd29d8",
313+
"is_secret": false,
314+
"is_verified": false,
315+
"line_number": 827,
316+
"type": "Secret Keyword",
317+
"verified_result": null
318+
}
319+
]
320+
},
321+
"version": "0.13.1+ibm.64.dss",
322+
"word_list": {
323+
"file": null,
324+
"hash": null
325+
}
326+
}

0 commit comments

Comments
 (0)