chore: move secret ignoring logic inside the scanner #1016
Conversation
gg-mmill
changed the title
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1016 +/- ##
==========================================
- Coverage 92.04% 91.91% -0.13%
==========================================
Files 181 181
Lines 7704 7683 -21
==========================================
- Hits 7091 7062 -29
- Misses 613 621 +8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚨 Try these New Features:
|
gg-mmill
force-pushed
the
mmillet/-/refactor_secret_ignoring
branch
5 times, most recently
from
5875d48
to
00144cd
Compare
gg-mmill
force-pushed
the
mmillet/-/refactor_secret_ignoring
branch
from
00144cd
to
00dc593
Compare
tests/unit/core/test_filter.py
Outdated
| copy_result = copy.deepcopy(scan_result) | ||
| ignored_matches = [IgnoredMatch(name="", match=x) for x in ignores] | ||
| remove_ignored_from_result(copy_result, ignored_matches) | ||
| # print("CONTENT", scan_result.policy_breaks[0].matches[0].match) |
| assert prev != tmpdir | ||
| with cd(tmpdir): | ||
| assert os.getcwd() == tmpdir | ||
| assert os.getcwd() == prev |
There was a problem hiding this comment.
Not sure why this is here, but more tests is good :)
There was a problem hiding this comment.
This was in tests/unit/verticals/secret/test_scan.py, that I removed
| @property | ||
| def has_secrets(self) -> bool: | ||
| return (self.new_secrets_count + self.known_secrets_count) > 0 | ||
| self.all_results = list(self.get_all_results()) |
There was a problem hiding this comment.
I am not a fan of having results in both self.results and in self.all_results, do we really need this new member?
There was a problem hiding this comment.
We can do without - I feel like the interface of SecretScanCollection is kinda flawed no matter what we do though, because of how it's mixing up results, nested scan results, etc.
Changed to total_policy_breaks_count -> more correct, as Results can now be empty of policy breaks
gg-mmill
force-pushed
the
mmillet/-/refactor_secret_ignoring
branch
3 times, most recently
from
b464bc7
to
58e2ed4
Compare
gg-mmill
force-pushed
the
mmillet/-/refactor_secret_ignoring
branch
from
58e2ed4
to
f63ed44
Compare
Context
Currently, there are logic related to ignoring secrets in two places:
What has been done
Move all the logic to the scanner:
Validation
Need to add tests for the scannerDoneWill also perform some manual validation
PR check list
skip-changeloglabel has been added to the PR.