detect-secrets 1.0.5 → 1.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.changeset/config.json +11 -0
- package/.github/.markdownlint.yml +9 -0
- package/{CODE_OF_CONDUCT.md → .github/CODE_OF_CONDUCT.md} +1 -1
- package/.github/dependabot.yml +59 -0
- package/.github/labeler.yml +20 -0
- package/.github/workflows/automerge.yml +39 -0
- package/.github/workflows/ci.yml +38 -0
- package/.github/workflows/labeler.yml +14 -0
- package/.github/workflows/links-checker-schedule.yml +43 -0
- package/.github/workflows/lock-threads.yml +34 -0
- package/.github/workflows/markdown-lint.yml +29 -0
- package/.github/workflows/release.yml +43 -0
- package/.github/workflows/repo-init.yml +37 -0
- package/.markdownlintignore +16 -0
- package/CHANGELOG.md +7 -0
- package/CONTRIBUTING.md +66 -18
- package/README.md +13 -3
- package/__tests__/cli.test.js +4 -1
- package/__tests__/isExecutableAvailableInPath.test.js +4 -0
- package/package.json +26 -35
- package/.travis.yml +0 -14
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
|
|
3
|
+
"changelog": ["@changesets/changelog-github", { "repo": "lirantal/detect-secrets" }],
|
|
4
|
+
"commit": false,
|
|
5
|
+
"fixed": [],
|
|
6
|
+
"linked": [],
|
|
7
|
+
"access": "public",
|
|
8
|
+
"baseBranch": "master",
|
|
9
|
+
"updateInternalDependencies": "patch",
|
|
10
|
+
"ignore": []
|
|
11
|
+
}
|
|
@@ -68,6 +68,6 @@ members of the project's leadership.
|
|
|
68
68
|
## Attribution
|
|
69
69
|
|
|
70
70
|
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
|
|
71
|
-
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct
|
|
71
|
+
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct/
|
|
72
72
|
|
|
73
73
|
[homepage]: https://www.contributor-covenant.org
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
version: 2
|
|
2
|
+
updates:
|
|
3
|
+
- package-ecosystem: "github-actions"
|
|
4
|
+
directory: ".github/workflows"
|
|
5
|
+
schedule:
|
|
6
|
+
interval: "monthly"
|
|
7
|
+
commit-message:
|
|
8
|
+
# Prefix all commit messages with "chore: "
|
|
9
|
+
prefix: "chore"
|
|
10
|
+
open-pull-requests-limit: 10
|
|
11
|
+
cooldown:
|
|
12
|
+
default-days: 30
|
|
13
|
+
# Use the 'dependencies' default label and add
|
|
14
|
+
# the 'automerge' one for automerge github action support
|
|
15
|
+
labels:
|
|
16
|
+
- "dependencies"
|
|
17
|
+
- "automerge"
|
|
18
|
+
|
|
19
|
+
- package-ecosystem: "npm"
|
|
20
|
+
directory: "/"
|
|
21
|
+
commit-message:
|
|
22
|
+
# Prefix all commit messages with "chore: "
|
|
23
|
+
prefix: "chore"
|
|
24
|
+
schedule:
|
|
25
|
+
interval: "weekly"
|
|
26
|
+
open-pull-requests-limit: 10
|
|
27
|
+
cooldown:
|
|
28
|
+
default-days: 30
|
|
29
|
+
semver-major-days: 30
|
|
30
|
+
semver-minor-days: 30
|
|
31
|
+
semver-patch-days: 30
|
|
32
|
+
# Use the 'dependencies' default label and add
|
|
33
|
+
# the 'automerge' one for automerge github action support
|
|
34
|
+
labels:
|
|
35
|
+
- "dependencies"
|
|
36
|
+
- "automerge"
|
|
37
|
+
groups:
|
|
38
|
+
# Production dependencies without breaking changes
|
|
39
|
+
dependencies:
|
|
40
|
+
dependency-type: "production"
|
|
41
|
+
update-types:
|
|
42
|
+
- "minor"
|
|
43
|
+
- "patch"
|
|
44
|
+
# Production dependencies with breaking changes
|
|
45
|
+
dependencies-major:
|
|
46
|
+
dependency-type: "production"
|
|
47
|
+
update-types:
|
|
48
|
+
- "major"
|
|
49
|
+
# Development dependencies
|
|
50
|
+
dev-dependencies:
|
|
51
|
+
dependency-type: "development"
|
|
52
|
+
update-types:
|
|
53
|
+
- "minor"
|
|
54
|
+
- "patch"
|
|
55
|
+
# example for ignoring dependencies:
|
|
56
|
+
# ignore:
|
|
57
|
+
# - dependency-name: tap
|
|
58
|
+
# update-types: ["version-update:semver-major"]
|
|
59
|
+
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
documentation:
|
|
2
|
+
- changed-files:
|
|
3
|
+
- any-glob-to-any-file:
|
|
4
|
+
- "docs/*"
|
|
5
|
+
- "**/*.md"
|
|
6
|
+
- "guides/*"
|
|
7
|
+
|
|
8
|
+
build:
|
|
9
|
+
- changed-files:
|
|
10
|
+
- any-glob-to-any-file: ".github/workflows/*"
|
|
11
|
+
|
|
12
|
+
typescript:
|
|
13
|
+
- changed-files:
|
|
14
|
+
- any-glob-to-any-file: "**/*[.|-]d.ts"
|
|
15
|
+
|
|
16
|
+
cli:
|
|
17
|
+
- any: ["bin/**/*", "cli/**/*"]
|
|
18
|
+
|
|
19
|
+
test:
|
|
20
|
+
- any: ["test/**/*", "__tests__/**/*"]
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
name: automerge
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
pull_request:
|
|
5
|
+
types:
|
|
6
|
+
- labeled
|
|
7
|
+
- unlabeled
|
|
8
|
+
- synchronize
|
|
9
|
+
- opened
|
|
10
|
+
- edited
|
|
11
|
+
- ready_for_review
|
|
12
|
+
- reopened
|
|
13
|
+
check_run:
|
|
14
|
+
types:
|
|
15
|
+
- completed
|
|
16
|
+
status: {}
|
|
17
|
+
|
|
18
|
+
permissions: {} # deny-all at workflow level; each job declares only what it needs
|
|
19
|
+
|
|
20
|
+
jobs:
|
|
21
|
+
automerge:
|
|
22
|
+
name: Automerge
|
|
23
|
+
runs-on: ubuntu-latest
|
|
24
|
+
if: github.event_name != 'check_run' || github.event.check_run.name != 'Automerge'
|
|
25
|
+
permissions:
|
|
26
|
+
contents: write
|
|
27
|
+
pull-requests: write
|
|
28
|
+
checks: read
|
|
29
|
+
statuses: read
|
|
30
|
+
steps:
|
|
31
|
+
- name: Merge eligible pull requests
|
|
32
|
+
uses: lirantal/github-action-automerge@e2d68a8230f993393412ac28362eb4e6108ca93c # 1.0.2
|
|
33
|
+
with:
|
|
34
|
+
label: automerge
|
|
35
|
+
merge-method: squash
|
|
36
|
+
green-observations-required: "4"
|
|
37
|
+
poll-interval-seconds: "60"
|
|
38
|
+
timeout-seconds: "3600"
|
|
39
|
+
ignored-check-names: Automerge
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
on: [push, pull_request]
|
|
4
|
+
|
|
5
|
+
permissions: {}
|
|
6
|
+
|
|
7
|
+
jobs:
|
|
8
|
+
test:
|
|
9
|
+
permissions:
|
|
10
|
+
contents: read
|
|
11
|
+
strategy:
|
|
12
|
+
matrix:
|
|
13
|
+
node: ["24.x"]
|
|
14
|
+
platform: [ubuntu-latest]
|
|
15
|
+
name: Node v${{matrix.node}} ((${{matrix.platform}}))
|
|
16
|
+
runs-on: ${{matrix.platform}}
|
|
17
|
+
steps:
|
|
18
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
19
|
+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
20
|
+
with:
|
|
21
|
+
node-version: ${{matrix.node}}
|
|
22
|
+
- name: install dependencies
|
|
23
|
+
run: npm ci --legacy-peer-deps
|
|
24
|
+
- name: lint code
|
|
25
|
+
run: npm run lint
|
|
26
|
+
- name: build project
|
|
27
|
+
run: npm run build
|
|
28
|
+
- name: run tests
|
|
29
|
+
run: npm run test
|
|
30
|
+
- name: coverage
|
|
31
|
+
uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
|
|
32
|
+
if: github.actor != 'dependabot[bot]'
|
|
33
|
+
with:
|
|
34
|
+
fail_ci_if_error: false
|
|
35
|
+
verbose: false
|
|
36
|
+
token: ${{ secrets.CODECOV_TOKEN }}
|
|
37
|
+
env:
|
|
38
|
+
CI: true
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
name: "Pull Request Labeler"
|
|
2
|
+
|
|
3
|
+
on: pull_request
|
|
4
|
+
|
|
5
|
+
permissions: {}
|
|
6
|
+
|
|
7
|
+
jobs:
|
|
8
|
+
label:
|
|
9
|
+
permissions:
|
|
10
|
+
contents: read
|
|
11
|
+
pull-requests: write
|
|
12
|
+
runs-on: ubuntu-latest
|
|
13
|
+
steps:
|
|
14
|
+
- uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
name: Links Checker (Lychee, On Schedule)
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
repository_dispatch:
|
|
5
|
+
workflow_dispatch:
|
|
6
|
+
schedule:
|
|
7
|
+
- cron: "00 18 * * *"
|
|
8
|
+
|
|
9
|
+
permissions: {}
|
|
10
|
+
|
|
11
|
+
jobs:
|
|
12
|
+
linkChecker:
|
|
13
|
+
permissions:
|
|
14
|
+
contents: read
|
|
15
|
+
issues: write
|
|
16
|
+
runs-on: ubuntu-latest
|
|
17
|
+
steps:
|
|
18
|
+
- name: Check out repo
|
|
19
|
+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
20
|
+
with:
|
|
21
|
+
persist-credentials: false
|
|
22
|
+
|
|
23
|
+
- name: Restore lychee cache
|
|
24
|
+
uses: actions/cache@v6
|
|
25
|
+
with:
|
|
26
|
+
path: .lycheecache
|
|
27
|
+
key: cache-lychee-${{ github.sha }}
|
|
28
|
+
restore-keys: cache-lychee-
|
|
29
|
+
|
|
30
|
+
- name: Link Checker
|
|
31
|
+
id: lychee
|
|
32
|
+
uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
|
|
33
|
+
with:
|
|
34
|
+
args: --root-dir "$(pwd)" --cache --max-cache-age 1d . --max-retries 5 --retry-wait-time 60 --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" --remap '.*npmjs\.org/package/(.*) https://registry.npmjs.com/$1' --remap '.*npmjs\.com/package/(.*) https://registry.npmjs.com/$1' --max-concurrency 1 -vv
|
|
35
|
+
fail: false
|
|
36
|
+
|
|
37
|
+
- name: Create Issue From File
|
|
38
|
+
if: steps.lychee.outputs.exit_code != 0
|
|
39
|
+
uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
|
|
40
|
+
with:
|
|
41
|
+
title: Link Checker Report (lycheeverse/lychee-action)
|
|
42
|
+
content-filepath: ./lychee/out.md
|
|
43
|
+
labels: report, automated issue
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: stale
|
|
3
|
+
|
|
4
|
+
on:
|
|
5
|
+
workflow_dispatch:
|
|
6
|
+
schedule:
|
|
7
|
+
- cron: "9 9 * * *"
|
|
8
|
+
|
|
9
|
+
permissions:
|
|
10
|
+
issues: write
|
|
11
|
+
pull-requests: write
|
|
12
|
+
|
|
13
|
+
jobs:
|
|
14
|
+
stale:
|
|
15
|
+
runs-on: ubuntu-latest
|
|
16
|
+
steps:
|
|
17
|
+
- uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
|
|
18
|
+
with:
|
|
19
|
+
close-issue-message: |
|
|
20
|
+
This issue has not seen any activity since it was marked stale.
|
|
21
|
+
Closing.
|
|
22
|
+
close-pr-message: |
|
|
23
|
+
This pull request has not seen any activity since it was marked stale.
|
|
24
|
+
Closing.
|
|
25
|
+
exempt-issue-labels: good-first-issue,need-help,no-stale,pinned,security
|
|
26
|
+
exempt-pr-labels: "autorelease: pending,good-first-issue,need-help,no-stale,pinned,security"
|
|
27
|
+
stale-issue-label: stale
|
|
28
|
+
stale-issue-message: |
|
|
29
|
+
This issue is stale because it has been open 60 days with no activity.
|
|
30
|
+
Remove stale label or comment or this will be closed in 7 days
|
|
31
|
+
stale-pr-label: stale
|
|
32
|
+
stale-pr-message: |
|
|
33
|
+
This PR is stale because it has been open 60 days with no activity.
|
|
34
|
+
Remove stale label or comment or this will be closed in 7 days.
|
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
name: Markdown Lint
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches:
|
|
6
|
+
- master
|
|
7
|
+
pull_request:
|
|
8
|
+
|
|
9
|
+
permissions: {}
|
|
10
|
+
|
|
11
|
+
jobs:
|
|
12
|
+
markdown_lint:
|
|
13
|
+
permissions:
|
|
14
|
+
contents: read
|
|
15
|
+
name: Lint Markdown files
|
|
16
|
+
runs-on: ubuntu-latest
|
|
17
|
+
steps:
|
|
18
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
19
|
+
|
|
20
|
+
- name: Setup Node.js
|
|
21
|
+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
22
|
+
with:
|
|
23
|
+
node-version: '24.x'
|
|
24
|
+
|
|
25
|
+
- name: Install dependencies
|
|
26
|
+
run: npm ci --legacy-peer-deps
|
|
27
|
+
|
|
28
|
+
- name: Markdown Lint
|
|
29
|
+
run: npm run lint:markdown || true
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
name: release
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches:
|
|
6
|
+
- master
|
|
7
|
+
|
|
8
|
+
concurrency: ${{ github.workflow }}-${{ github.ref }}
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
release:
|
|
14
|
+
permissions:
|
|
15
|
+
contents: write # to create release (changesets/action)
|
|
16
|
+
issues: write # to post issue comments (changesets/action)
|
|
17
|
+
pull-requests: write # to create pull request (changesets/action)
|
|
18
|
+
id-token: write # to create release (changesets/action)
|
|
19
|
+
packages: write # to publish to npm (changesets/action)
|
|
20
|
+
timeout-minutes: 20
|
|
21
|
+
runs-on: ubuntu-latest
|
|
22
|
+
steps:
|
|
23
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
24
|
+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
25
|
+
with:
|
|
26
|
+
node-version: 24.x
|
|
27
|
+
registry-url: https://registry.npmjs.org
|
|
28
|
+
package-manager-cache: false
|
|
29
|
+
- name: install dependencies
|
|
30
|
+
run: npm ci --legacy-peer-deps
|
|
31
|
+
- name: build project
|
|
32
|
+
run: npm run build
|
|
33
|
+
- name: Create Release Pull Request or Publish to npm
|
|
34
|
+
uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
|
|
35
|
+
with:
|
|
36
|
+
publish-script: npm run release
|
|
37
|
+
version-script: npm run version
|
|
38
|
+
commit-message: "chore: new release"
|
|
39
|
+
pr-title: "chore: new release candidate"
|
|
40
|
+
env:
|
|
41
|
+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
42
|
+
# Register lirantal/detect-secrets and release.yml as an npm trusted publisher.
|
|
43
|
+
NPM_TOKEN: ''
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
name: Repository init
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
workflow_dispatch:
|
|
5
|
+
push:
|
|
6
|
+
branches: [master]
|
|
7
|
+
paths:
|
|
8
|
+
- '.github/workflows/repo-init.yml' # only fires when this file itself changes
|
|
9
|
+
schedule:
|
|
10
|
+
- cron: '0 9 * * 1' # Every Monday at 09:00 UTC
|
|
11
|
+
|
|
12
|
+
permissions: {} # deny-all at workflow level; each job declares only what it needs
|
|
13
|
+
|
|
14
|
+
jobs:
|
|
15
|
+
create-label:
|
|
16
|
+
runs-on: ubuntu-latest
|
|
17
|
+
permissions:
|
|
18
|
+
issues: write
|
|
19
|
+
steps:
|
|
20
|
+
- name: Create automerge label
|
|
21
|
+
env:
|
|
22
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
23
|
+
run: |
|
|
24
|
+
gh label create "automerge" \
|
|
25
|
+
--repo "${{ github.repository }}" \
|
|
26
|
+
--color "0075ca" \
|
|
27
|
+
--description "Merge this PR automatically once checks pass" \
|
|
28
|
+
--force
|
|
29
|
+
- name: Create dependencies label
|
|
30
|
+
env:
|
|
31
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
32
|
+
run: |
|
|
33
|
+
gh label create "dependencies" \
|
|
34
|
+
--repo "${{ github.repository }}" \
|
|
35
|
+
--color "0366d6" \
|
|
36
|
+
--description "Pull requests that update a dependency" \
|
|
37
|
+
--force
|
package/CHANGELOG.md
ADDED
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
# detect-secrets
|
|
2
|
+
|
|
3
|
+
## 1.0.7
|
|
4
|
+
|
|
5
|
+
### Major Changes
|
|
6
|
+
|
|
7
|
+
- [#56](https://github.com/lirantal/detect-secrets/pull/56) [`0eff1af`](https://github.com/lirantal/detect-secrets/commit/0eff1af8bdd9e333063f86777f18e4e04880b7cd) Thanks [@lirantal](https://github.com/lirantal)! - Upgrade executable resolution to which 7. Require Node.js ^24.15.0 or >=26.0.0, dropping earlier Node 24 releases and unsupported Node 25.
|
package/CONTRIBUTING.md
CHANGED
|
@@ -1,34 +1,82 @@
|
|
|
1
1
|
# Contributing
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Thanks for taking the time to contribute! Issues, ideas, and PRs are all welcome.
|
|
4
|
+
The notes below are guidelines to help your contribution land smoothly. If in doubt, open the thing anyway and we'll figure it out together.
|
|
4
5
|
|
|
5
|
-
|
|
6
|
-
These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
|
|
6
|
+
## Opening an issue
|
|
7
7
|
|
|
8
|
-
|
|
8
|
+
A good issue gives us enough to reproduce or understand the ask. Useful things to include:
|
|
9
9
|
|
|
10
|
-
|
|
10
|
+
- **For bugs:** what you expected, what actually happened, and the shortest repro you can manage. Versions (runtime, OS, package) and stack traces help.
|
|
11
|
+
- **For features:** the problem you're trying to solve, not just the solution you have in mind. A concrete example of how you'd use it is gold.
|
|
11
12
|
|
|
12
|
-
|
|
13
|
+
A quick search of existing issues helps avoid duplicates, but don't agonize over it.
|
|
13
14
|
|
|
14
|
-
|
|
15
|
+
## Proposing a PR
|
|
15
16
|
|
|
16
|
-
|
|
17
|
+
PRs are expected to meet a few baseline requirements before review:
|
|
17
18
|
|
|
18
|
-
|
|
19
|
+
- **Tests are required** for any behavior change, new features need new tests, bug fixes need a regression test that fails without the fix.
|
|
20
|
+
- **Existing tests must pass** locally and in CI. Don't disable or skip tests to make a PR green.
|
|
21
|
+
- **Coverage should not regress.** If your change drops coverage meaningfully, add tests or explain why in the PR description.
|
|
22
|
+
- **Linters and type checks must pass.** Run them locally before pushing; CI will reject otherwise.
|
|
23
|
+
- **One logical change per PR.** Refactors, formatting churn, and unrelated fixes belong in separate PRs, it makes review and revert sane.
|
|
24
|
+
- **Describe what and why.** A PR title and a few lines of context go a long way, reviewers shouldn't have to reverse-engineer your intent from the diff.
|
|
25
|
+
- **Link the issue you're closing.** If your PR resolves an open issue, include a `Related issues` section in the description with `Fixes: #<issue-number>` (or `Closes: #<issue-number>`) so GitHub auto-closes it on merge.
|
|
26
|
+
- **Breaking changes need a heads-up** in the PR description, plus a migration note for users.
|
|
19
27
|
|
|
20
|
-
|
|
28
|
+
Large or speculative changes: open an issue first to align on direction before investing time.
|
|
21
29
|
|
|
22
|
-
|
|
23
|
-
|
|
30
|
+
## Commit guidelines
|
|
31
|
+
|
|
32
|
+
This project follows [Conventional Commits](https://www.conventionalcommits.org/). The format is:
|
|
33
|
+
|
|
34
|
+
```text
|
|
35
|
+
<type>(<optional scope>): <short summary>
|
|
24
36
|
```
|
|
25
37
|
|
|
26
|
-
|
|
38
|
+
Common types:
|
|
27
39
|
|
|
28
|
-
|
|
29
|
-
|
|
40
|
+
- `feat:` — a new feature
|
|
41
|
+
- `fix:` — a bug fix
|
|
42
|
+
- `docs:` — documentation only
|
|
43
|
+
- `refactor:` — code change that neither fixes a bug nor adds a feature
|
|
44
|
+
- `test:` — adding or fixing tests
|
|
45
|
+
- `chore:` — tooling, build, dependencies
|
|
46
|
+
- `perf:` — performance improvement
|
|
30
47
|
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
48
|
+
Examples:
|
|
49
|
+
|
|
50
|
+
```text
|
|
51
|
+
feat: support multiple input files
|
|
52
|
+
fix(parser): handle empty input gracefully
|
|
53
|
+
docs: clarify install instructions
|
|
34
54
|
```
|
|
55
|
+
|
|
56
|
+
Breaking changes: add `!` after the type (`feat!: ...`) and explain the break in the commit body.
|
|
57
|
+
|
|
58
|
+
This format drives changelog generation and release automation, so it matters more than the average commit-style guide.
|
|
59
|
+
|
|
60
|
+
## Local development
|
|
61
|
+
|
|
62
|
+
1. Fork and clone the repository.
|
|
63
|
+
2. Install dependencies using the project's package manager (see `package.json`, or equivalent).
|
|
64
|
+
3. Run the test suite to confirm a clean baseline before making changes.
|
|
65
|
+
4. Run the linter and type checker (if configured) the same way.
|
|
66
|
+
5. Make your change on a feature branch, commit using the format above, and open a PR.
|
|
67
|
+
|
|
68
|
+
If any of the above doesn't work on a fresh checkout, that's a bug, please open an issue.
|
|
69
|
+
|
|
70
|
+
## For automated agents
|
|
71
|
+
|
|
72
|
+
If you are an AI coding agent or automated bot opening a PR, please add 🤖🤖🤖 to the end of the PR title. This helps maintainers triage agent-authored contributions and is a baseline expectation for this repo — PRs without the marker that turn out to be automated may be closed without review.
|
|
73
|
+
|
|
74
|
+
The same applies to issues: prefix the title with 🤖🤖🤖 if it was opened by an agent on your behalf.
|
|
75
|
+
|
|
76
|
+
## Dependency release age
|
|
77
|
+
|
|
78
|
+
Dependabot waits 30 days for routine npm version updates. Security updates are
|
|
79
|
+
exempt from its cooldown and may arrive earlier; leave them unmerged until the
|
|
80
|
+
policy cutoff. Keep the install-time release-age configuration enabled.
|
|
81
|
+
Because `npm ci` trusts locked versions without rechecking publication age,
|
|
82
|
+
validate newly locked versions when reviewing an upgrade.
|
package/README.md
CHANGED
|
@@ -10,10 +10,8 @@
|
|
|
10
10
|
<a href="https://www.npmjs.org/package/detect-secrets"><img src="https://badgen.net/npm/v/detect-secrets" alt="npm version"/></a>
|
|
11
11
|
<a href="https://www.npmjs.org/package/detect-secrets"><img src="https://badgen.net/npm/license/detect-secrets" alt="license"/></a>
|
|
12
12
|
<a href="https://www.npmjs.org/package/detect-secrets"><img src="https://badgen.net/npm/dt/detect-secrets" alt="downloads"/></a>
|
|
13
|
-
<a href="https://
|
|
13
|
+
<a href="https://github.com/lirantal/detect-secrets/actions/workflows/ci.yml"><img src="https://github.com/lirantal/detect-secrets/actions/workflows/ci.yml/badge.svg?branch=master" alt="build"/></a>
|
|
14
14
|
<a href="https://codecov.io/gh/lirantal/detect-secrets"><img src="https://badgen.net/codecov/c/github/lirantal/detect-secrets" alt="codecov"/></a>
|
|
15
|
-
<a href="https://snyk.io/test/github/lirantal/detect-secrets"><img src="https://snyk.io/test/github/lirantal/detect-secrets/badge.svg" alt="Known Vulnerabilities"/></a>
|
|
16
|
-
<a href="https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md"><img src="https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow.svg" alt="Security Responsible Disclosure" /></a>
|
|
17
15
|
</p>
|
|
18
16
|
|
|
19
17
|
# About
|
|
@@ -38,6 +36,8 @@ The above described fallback strategy is used to find an available method of exe
|
|
|
38
36
|
|
|
39
37
|
# Install
|
|
40
38
|
|
|
39
|
+
Requires Node.js 24.15+ within Node 24, or Node.js 26+. Node.js 25 is not supported by which 7.
|
|
40
|
+
|
|
41
41
|
```bash
|
|
42
42
|
npm install --save detect-secrets
|
|
43
43
|
```
|
|
@@ -52,6 +52,16 @@ npx detect-secrets [arguments]
|
|
|
52
52
|
|
|
53
53
|
# Usage
|
|
54
54
|
|
|
55
|
+
If you're using `husky` to manage pre-commit hooks configuration, then enabling secrets detection is as simple as adding another hook entry.
|
|
56
|
+
|
|
57
|
+
```js
|
|
58
|
+
"husky": {
|
|
59
|
+
"hooks": {
|
|
60
|
+
"pre-commit": "detect-secrets-launcher src/*"
|
|
61
|
+
}
|
|
62
|
+
}
|
|
63
|
+
```
|
|
64
|
+
|
|
55
65
|
If you're using `husky` and `lint-staged` to manage pre-commit hooks configuration and running static code analysis on staged files, then enabling secrets detection is as simple as adding another lint-staged entry.
|
|
56
66
|
|
|
57
67
|
A typical setup will look like this as an example:
|
package/__tests__/cli.test.js
CHANGED
|
@@ -4,7 +4,10 @@
|
|
|
4
4
|
const cli = require('../src/cli')
|
|
5
5
|
|
|
6
6
|
describe('detect-secrets-launcher CLI', () => {
|
|
7
|
-
|
|
7
|
+
const originalArgv = process.argv
|
|
8
|
+
beforeEach(() => { process.argv = [process.execPath, 'detect-secrets-launcher'] })
|
|
9
|
+
afterEach(() => { process.argv = originalArgv })
|
|
10
|
+
test('when successful to spawn a strategy should return exit code 0', () => {
|
|
8
11
|
const executableStrategies = [
|
|
9
12
|
{
|
|
10
13
|
type: 'ls',
|
|
@@ -3,6 +3,10 @@
|
|
|
3
3
|
const {isExecutableAvailableInPath} = require('../src/strategies')
|
|
4
4
|
|
|
5
5
|
describe('Strategies: isExecutableAvailableInPath', () => {
|
|
6
|
+
test('resolves the running Node executable using the real which dependency', () => {
|
|
7
|
+
expect(isExecutableAvailableInPath(process.execPath)).toBe(true)
|
|
8
|
+
})
|
|
9
|
+
|
|
6
10
|
test('should find a binary and result in success', () => {
|
|
7
11
|
const executable = 'ls'
|
|
8
12
|
const result = isExecutableAvailableInPath(executable)
|
package/package.json
CHANGED
|
@@ -1,12 +1,13 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "detect-secrets",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.7",
|
|
4
4
|
"description": "A developer-friendly secrets detection tool for CI and pre-commit hooks based on Yelp's detect-secrets",
|
|
5
5
|
"bin": {
|
|
6
6
|
"detect-secrets-launcher": "./bin/detect-secrets-launcher.js"
|
|
7
7
|
},
|
|
8
8
|
"engines": {
|
|
9
|
-
"
|
|
9
|
+
"npm": ">=11.10.0",
|
|
10
|
+
"node": "^24.15.0 || >=26.0.0"
|
|
10
11
|
},
|
|
11
12
|
"scripts": {
|
|
12
13
|
"lint": "eslint .",
|
|
@@ -19,7 +20,10 @@
|
|
|
19
20
|
"docs": "npm run docs:code && npm run docs:api",
|
|
20
21
|
"docs:api": "doxdox *.js --layout bootstrap --output docs/index.html",
|
|
21
22
|
"docs:code": "docco *.js --output docs/code",
|
|
22
|
-
"
|
|
23
|
+
"build": "echo \"No build step configured\"",
|
|
24
|
+
"lint:markdown": "markdownlint -c .github/.markdownlint.yml '**/**.md'",
|
|
25
|
+
"version": "changeset version",
|
|
26
|
+
"release": "changeset publish"
|
|
23
27
|
},
|
|
24
28
|
"author": {
|
|
25
29
|
"name": "Liran Tal",
|
|
@@ -45,40 +49,43 @@
|
|
|
45
49
|
"url": "https://github.com/lirantal/detect-secrets.git"
|
|
46
50
|
},
|
|
47
51
|
"dependencies": {
|
|
48
|
-
"debug": "^4.
|
|
49
|
-
"which": "^
|
|
52
|
+
"debug": "^4.3.3",
|
|
53
|
+
"which": "^7.0.0"
|
|
50
54
|
},
|
|
51
55
|
"devDependencies": {
|
|
52
|
-
"@commitlint/cli": "^
|
|
53
|
-
"@commitlint/config-conventional": "^
|
|
56
|
+
"@commitlint/cli": "^21.2.3",
|
|
57
|
+
"@commitlint/config-conventional": "^21.2.3",
|
|
54
58
|
"babel-eslint": "^10.0.1",
|
|
55
59
|
"babel-plugin-syntax-async-functions": "^6.13.0",
|
|
56
60
|
"babel-plugin-transform-regenerator": "^6.26.0",
|
|
57
61
|
"babel-preset-env": "^1.6.1",
|
|
58
62
|
"babel-preset-es2015": "^6.24.1",
|
|
59
|
-
"commitizen": "^
|
|
63
|
+
"commitizen": "^4.3.2",
|
|
60
64
|
"cz-conventional-changelog": "^1.2.0",
|
|
61
|
-
"docco": "^0.
|
|
62
|
-
"doxdox": "^
|
|
65
|
+
"docco": "^0.9.2",
|
|
66
|
+
"doxdox": "^3.0.0",
|
|
63
67
|
"eslint": "^5.10.0",
|
|
64
68
|
"eslint-config-standard": "^12.0.0",
|
|
65
69
|
"eslint-plugin-import": "^2.14.0",
|
|
66
70
|
"eslint-plugin-jest": "^22.1.2",
|
|
67
71
|
"eslint-plugin-node": "^8.0.0",
|
|
68
|
-
"eslint-plugin-promise": "^
|
|
72
|
+
"eslint-plugin-promise": "^7.3.0",
|
|
69
73
|
"eslint-plugin-security": "^1.4.0",
|
|
70
74
|
"eslint-plugin-standard": "^4.0.0",
|
|
71
|
-
"husky": "^1.
|
|
72
|
-
"jest": "
|
|
75
|
+
"husky": "^9.1.7",
|
|
76
|
+
"jest": "^30.5.2",
|
|
73
77
|
"lint-staged": "^8.1.0",
|
|
74
|
-
"opn-cli": "^
|
|
78
|
+
"opn-cli": "^5.0.0",
|
|
79
|
+
"prettier": "^3.9.9",
|
|
75
80
|
"prettier-standard": "^8.0.1",
|
|
76
|
-
"
|
|
81
|
+
"@changesets/changelog-github": "^0.6.0",
|
|
82
|
+
"@changesets/cli": "^3.0.3",
|
|
83
|
+
"markdownlint-cli": "0.49.1",
|
|
84
|
+
"semantic-release": "25.0.9"
|
|
77
85
|
},
|
|
78
86
|
"jest": {
|
|
79
87
|
"testEnvironment": "node",
|
|
80
88
|
"verbose": true,
|
|
81
|
-
"notify": true,
|
|
82
89
|
"collectCoverage": true,
|
|
83
90
|
"coverageThreshold": {
|
|
84
91
|
"global": {
|
|
@@ -182,24 +189,8 @@
|
|
|
182
189
|
}
|
|
183
190
|
}
|
|
184
191
|
},
|
|
185
|
-
"
|
|
186
|
-
"
|
|
187
|
-
"
|
|
188
|
-
"preset": "angular",
|
|
189
|
-
"releaseRules": [
|
|
190
|
-
{
|
|
191
|
-
"type": "docs",
|
|
192
|
-
"release": "patch"
|
|
193
|
-
},
|
|
194
|
-
{
|
|
195
|
-
"type": "refactor",
|
|
196
|
-
"release": "patch"
|
|
197
|
-
},
|
|
198
|
-
{
|
|
199
|
-
"type": "style",
|
|
200
|
-
"release": "patch"
|
|
201
|
-
}
|
|
202
|
-
]
|
|
203
|
-
}
|
|
192
|
+
"publishConfig": {
|
|
193
|
+
"provenance": true,
|
|
194
|
+
"access": "public"
|
|
204
195
|
}
|
|
205
196
|
}
|
package/.travis.yml
DELETED