Merge branch 'main' into fix-privatelink-snowflake-detector

* main: (79 commits) Log skipped files on debug level (trufflesecurity#3383) build: update retracted bluemonday ver (trufflesecurity#3369) Fix git binary handling and add a smoke test (trufflesecurity#3379) fix(deps): update module google.golang.org/protobuf to v1.35.1 (trufflesecurity#3382) Added Cisco Meraki API Key detector (trufflesecurity#3367) improved the agora detector (trufflesecurity#3360) fix(deps): update module github.com/xanzy/go-gitlab to v0.110.0 (trufflesecurity#3376) fix(deps): update golang.org/x/exp digest to 225e2ab (trufflesecurity#3371) fix(deps): update module golang.org/x/net to v0.30.0 (trufflesecurity#3373) fix(deps): update module golang.org/x/crypto to v0.28.0 (trufflesecurity#3372) chore(deps): update sigstore/cosign-installer action to v3.7.0 (trufflesecurity#3368) fix(deps): update module cloud.google.com/go/storage to v1.44.0 (trufflesecurity#3366) fix(deps): update module github.com/schollz/progressbar/v3 to v3.16.1 (trufflesecurity#3365) [refactor] - Decouple Metrics From Cache Implementation (trufflesecurity#3355) fix(deps): update module github.com/snowflakedb/gosnowflake to v1.11.2 (trufflesecurity#3363) Updated Cosign Install URL (trufflesecurity#3364) fix(deps): update module github.com/jedib0t/go-pretty/v6 to v6.6.0 (trufflesecurity#3361) Added Pattern test cases for detectors (trufflesecurity#3354) remove size check (trufflesecurity#3351) fix(deps): update module go.mongodb.org/mongo-driver to v1.17.1 (trufflesecurity#3357) ... # Conflicts: # go.sum
abmussani · Oct 9, 2024 · 1276dde · 1276dde
2 parents 04f796e + 23afcd7
commit 1276dde
Show file tree

Hide file tree

Showing 980 changed files with 15,860 additions and 4,182 deletions.
diff --git a/.captain/config.yaml b/.captain/config.yaml
@@ -0,0 +1,11 @@
+test-suites:
+  detectors:
+    command: gotestsum --jsonfile tmp/go-test.json --raw-command -- go test -tags=detectors -timeout=15m -json -count=1 -vet=off ./pkg/detectors/...
+    results:
+      path: tmp/go-test.json
+    output:
+      print-summary: true
+    ## No retries right now
+    # retries:
+    #   attempts: 3
+    #   command: gotestsum --raw-command --jsonfile tmp/go-test.json -- go test -tags=detectors -timeout=15m -json -count=1 -vet=off {{ package }} -run '{{ run }}'
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

diff --git a/.github/workflows/detector-tests.yml b/.github/workflows/detector-tests.yml
@@ -1,4 +1,4 @@
-name: detector test aggregation
+name: Detectors Aggregation
 
 on:
   workflow_dispatch:
@@ -14,35 +14,16 @@ jobs:
       contents: "read"
       id-token: "write"
     steps:
-      - name: Install Go
-        uses: actions/setup-go@v5
+      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v4
+      - name: Install gotestsum
+        uses: jaxxstorm/action-install-gh-release@v1.12.0
         with:
-          go-version: "1.22"
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - id: "auth"
-        uses: "google-github-actions/auth@v2"
-        with:
-          workload_identity_provider: "projects/811013774421/locations/global/workloadIdentityPools/github-pool/providers/github-provider"
-          service_account: "github-ci-external@trufflehog-testing.iam.gserviceaccount.com"
-      - name: Test integration
-        continue-on-error: true
-        run: make test-integration
-      - name: Set up gotestsum
-        run: |
-          go install gotest.tools/gotestsum@latest
-          mkdir -p tmp/test-results
-      - name: Test detectors
+          repo: gotestyourself/gotestsum
+      - uses: rwx-research/setup-captain@v1
+      - name: Test Go
         run: |
-          CGO_ENABLED=1 gotestsum --junitfile tmp/test-results/test.xml --raw-command -- go test -json -tags=detectors -timeout=15m $(go list ./... | grep pkg/detectors)
-      - name: Upload test results to BuildPulse for flaky test detection
-        if: ${{ !cancelled() }} # Run this step even when the tests fail. Skip if the workflow is cancelled.
-        uses: buildpulse/buildpulse-action@main
-        with:
-          account: 79229934
-          repository: 694446374
-          path: |
-            tmp/test-results/*.xml
-          key: ${{ secrets.BUILDPULSE_DETECTORS_ACCESS_KEY_ID }}
-          secret: ${{ secrets.BUILDPULSE_DETECTORS_SECRET_ACCESS_KEY }}
-          tags: detectors
+          export CGO_ENABLED=1
+          captain run detectors
+        env:
+          RWX_ACCESS_TOKEN: ${{ secrets.RWX_ACCESS_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - uses: actions/checkout@v4
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v6

diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
@@ -13,7 +13,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
 
       - name: Checkout code
         uses: actions/checkout@v4

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -36,9 +36,9 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - name: Cosign install
-        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:

diff --git a/.github/workflows/secrets.yml b/.github/workflows/secrets.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   test:
-    if: github.repository == 'trufflesecurity/trufflehog'
+    if: ${{ github.repository == 'trufflesecurity/trufflehog' && !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
@@ -10,11 +10,44 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Smoke
         run: |
           set -e
-          go run . git https://github.com/dustin-decker/secretsandstuff.git
-          go run . github --repo https://github.com/dustin-decker/secretsandstuff.git
+          go run . git https://github.com/dustin-decker/secretsandstuff.git > /dev/null
+          go run . github --repo https://github.com/dustin-decker/secretsandstuff.git > /dev/null
+  zombies:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23"
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Run trufflehog
+        run: |
+          set -e
+          go run . git --no-verification file://. > /dev/null
+          # This case previously had a deadlock issue and left zombies after trufflehog exited #3379
+          go run . git --no-verification https://github.com/git-test-fixtures/binary.git > /dev/null
+      - name: Check for running git processes and zombies
+        run: |
+          if pgrep -x "git" > /dev/null
+          then
+            echo "Git processes are still running"
+            exit 1
+          else
+            echo "No git processes found"
+          fi
+
+          if ps -A -ostat,ppid | grep -e '[zZ]' > /dev/null
+          then
+            echo "Zombie processes found"
+            exit 1
+          else
+            echo "No zombie processes found"
+          fi
diff --git a/.github/workflows/snifftest.yml b/.github/workflows/snifftest.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - uses: actions/checkout@v4
       - name: Run Snifftest
         run: make snifftest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - name: Checkout code
         uses: actions/checkout@v4
       - id: "auth"
@@ -62,7 +62,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.23"
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Test

diff --git a/.gitignore b/.gitignore
@@ -5,3 +5,7 @@ dist
 
 # binary
 trufflehog
+tmp/go-test.json
+.captain/detectors/timings.yaml
+.captain/detectors/quarantines.yaml
+.captain/detectors/flakes.yaml
diff --git a/README.md b/README.md
@@ -127,7 +127,7 @@ Checksums are applied to all artifacts, and the resulting checksum file is signe
 
 You need the following tool to verify signature:
 
-- [Cosign](https://docs.sigstore.dev/cosign/installation/)
+- [Cosign](https://docs.sigstore.dev/cosign/system_config/installation/)
 
 Verification steps are as follow: