Skip to content

Commit

Permalink
Fix #245: Better boolean flag help output (#292)
Browse files Browse the repository at this point in the history 
* Upgrade click to latest

* Perform some pathing magic in tests to ensure it matches output

* Update CLI help output for docs

* Add a changelog entry about the click upgrade

* Fix PR # for click update

* Another shot at fixing Windows tests

* Match the path resolution to the latest version of click

* Move the output_dir calculation inside the context manager

* Tests become much simpler when you read their output properly.

* Remove the unused import to appease pylint
  • Loading branch information
@tarkatronic
tarkatronic authored Dec 8, 2021
1 parent e3d4c4e commit d70097e
Show file tree
Hide file tree
Showing 5 changed files with 71 additions and 73 deletions.
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ Bug fixes:
Misc:

* [#282](https://github.com/godaddy/tartufo/pull/282) - Remove old style config for `exclude-entropy-patterns`
* [#292](https://github.com/godaddy/tartufo/pull/292) - Use the latest `click`
to provide better output on boolean flag defaults

Features:

Expand Down
65 changes: 24 additions & 41 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,17 +45,21 @@ Usage: tartufo [OPTIONS] COMMAND [ARGS]...
commit hook.

Options:
--rules FILENAME Path(s) to regex rules json list file(s).
--rules FILENAME [DEPRECATED] Use the rule-patterns config
options instead. Path(s) to regex rules json
list file(s).
--default-regexes / --no-default-regexes
Whether to include the default regex list
when configuring search patterns. Only
applicable if --rules is also specified.
[default: True]

--entropy / --no-entropy Enable entropy checks. [default: True]
[default: default-regexes]
--entropy / --no-entropy Enable entropy checks. [default: entropy]
--regex / --no-regex Enable high signal regexes checks.
[default: True]

[default: regex]
--scan-filenames / --no-scan-filenames
Check the names of files being scanned as
well as their contents. [default: scan-
filenames]
-ip, --include-path-patterns TEXT
Specify a regular expression which matches
Git object paths to include in the scan.
Expand All @@ -64,7 +68,6 @@ Options:
provided (default), all Git object paths are
included unless otherwise excluded via the
--exclude-path-patterns option.

-xp, --exclude-path-patterns TEXT
Specify a regular expression which matches
Git object paths to exclude from the scan.
Expand All @@ -73,75 +76,58 @@ Options:
provided (default), no Git object paths are
excluded unless effectively excluded via the
--include-path-patterns option.

-of, --output-format [json|compact|text]
Specify the format in which the output needs
to be generated `--output-format
json/compact/text`. Either `json`, `compact`
or `text` can be specified. If not provided
(default) the output will be generated in
`text` format.

-xe, --exclude-entropy-patterns TEXT
Specify a regular expression which matches
entropy strings to exclude from the scan.
This option can be specified multiple times
to exclude multiple patterns. If not
provided (default), no entropy strings will
be excluded ({path regex}::{pattern regex}).

-e, --exclude-signatures TEXT Specify signatures of matches that you
explicitly want to exclude from the scan,
and mark as okay. These signatures are
generated during the scan process, and
reported out with each individual match.
This option can be specified multiple times,
to exclude as many signatures as you would
like.

-e, --exclude-signatures TEXT [DEPRECATED] Use the exclude-findings config
option instead. Specify signatures of
matches that you explicitly want to exclude
from the scan, and mark as okay. These
signatures are generated during the scan
process, and reported out with each
individual match. This option can be
specified multiple times, to exclude as many
signatures as you would like.
-od, --output-dir DIRECTORY If specified, all issues will be written out
as individual JSON files to a uniquely named
directory under this one. This will help
with keeping the results of individual runs
of tartufo separated.

--git-rules-repo TEXT A file path, or git URL, pointing to a git
repository containing regex rules to be used
for scanning. By default, all .json files
will be loaded from the root of that
repository. --git-rules-files can be used to
override this behavior and load specific
files.

--git-rules-files TEXT Used in conjunction with --git-rules-repo,
specify glob-style patterns for files from
which to load the regex rules. Can be
specified multiple times.

--config FILE Read configuration from specified file.
[default: tartufo.toml]

-q, --quiet / --no-quiet Quiet mode. No outputs are reported if the
scan is successful and doesn't find any
issues
-v, --verbose Display more verbose output. Specifying this
option multiple times will incrementally
increase the amount of output.
--log-timestamps / --no-log-timestamps
Enable or disable timestamps in logging
messages. [default: True]
messages. [default: log-timestamps]
--entropy-sensitivity INTEGER RANGE
Modify entropy detection sensitivity. This
is expressed as on a scale of 0 to 100,
where 0 means "totally nonrandom" and 100
means "totally random". Decreasing the
scanner's sensitivity increases the
likelihood that a given string will be
identified as suspicious. [default: 75]

identified as suspicious. [default: 75;
0<=x<=100]
-b64, --b64-entropy-score TEXT [DEPRECATED] Use `--entropy-sensitivity`.
Modify the base64 entropy score. If a value
greater than the default (4.5 in a range of
Expand All @@ -150,7 +136,6 @@ Options:
randomized strings. A lower value lists
lower entropy base64 strings (shorter or
less randomized strings).

-hex, --hex-entropy-score TEXT [DEPRECATED] Use `--entropy-sensitivity`.
Modify the hexadecimal entropy score. If a
value greater than the default (3.0 in a
Expand All @@ -160,16 +145,14 @@ Options:
value lists lower entropy hexadecimal
strings (shorter or less randomized
strings).

-V, --version Show the version and exit.
-h, --help Show this message and exit.

Commands:
scan-folder Scan a folder.
scan-remote-repo Automatically clone and scan a remote git repository.
pre-commit Scan staged changes in a pre-commit hook.
scan-remote-repo Automatically clone and scan a remote git repository.
scan-folder Scan a folder.
scan-local-repo Scan a repository already cloned to your local system.

```
## Contributing
Expand Down
57 changes: 36 additions & 21 deletions poetry.lock
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion pyproject.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ tartufo = "tartufo.cli:main"
[tool.poetry.dependencies]
GitPython = "<3.1.20"
pygit2 = "~1.6"
click = "^7"
click = "^8.0.3"
colorama = {version = "*", markers = "sys_platform == 'win32'"}
dataclasses = {version = "*", python = "< 3.7"}
python = "^3.6.2"
Expand Down
18 changes: 8 additions & 10 deletions tests/test_cli.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -100,15 +100,14 @@ def test_output_dir_is_called_out(
mock_dt.now.return_value.isoformat.return_value = "nownownow"
runner = CliRunner()
with runner.isolated_filesystem() as dirname:
output_dir = (Path(dirname) / "foo").resolve()
result = runner.invoke(
cli.main, ["--output-dir", "./foo", "scan-local-repo", "."]
cli.main, ["--output-dir", str(output_dir), "scan-local-repo", "."]
)
output_dir = (
Path(dirname) / "foo" / "tartufo-scan-results-nownownow"
).resolve()
result_dir = output_dir / "tartufo-scan-results-nownownow"
self.assertEqual(
result.output,
f"Results have been saved in {output_dir}\n",
f"Results have been saved in {result_dir}\n",
)

@unittest.skipUnless(helpers.WINDOWS, "Test is Windows-only")
Expand All @@ -130,15 +129,14 @@ def test_output_dir_is_valid_name_in_windows(
mock_dt.now.return_value.isoformat.return_value = "now:now:now"
runner = CliRunner()
with runner.isolated_filesystem() as dirname:
output_dir = (Path(dirname) / "foo").resolve()
result = runner.invoke(
cli.main, ["--output-dir", "./foo", "scan-local-repo", "."]
cli.main, ["--output-dir", str(output_dir), "scan-local-repo", "."]
)
output_dir = (
Path(dirname) / "foo" / "tartufo-scan-results-nownownow"
).resolve()
result_dir = output_dir / "tartufo-scan-results-nownownow"
self.assertEqual(
result.output,
f"Results have been saved in {output_dir}\n",
f"Results have been saved in {result_dir}\n",
)

@mock.patch("tartufo.commands.scan_local_repo.GitRepoScanner")
Expand Down

0 comments on commit d70097e

Please sign in to comment.