Guardrails / secrets

A secret detector scanned the checkout

secrets/detector-ran@v1

A secret detector ran on the checkout, or left a report the build can be judged on, so something has actually looked for credentials.

Id	secrets/detector-ran
Version	v1
Category	secrets
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	secrets

Collectors

This guardrail doesn't gather anything itself. It relies on the collectors below, which the CLI runs once per build before any check, and reads what they found from GUARDRAIL_FACTS. If a collector collects nothing, this guardrail is skipped, not failed.

Collector	Gathers	Inputs it is given
secrets	Secrets found in the checkout, read from the report a secret scanner already left behind, or collected by running gitleaks or trufflehog when the runner carries one and no report is there. Only the rule, the file, the line and a fingerprint are collected: the matched value never is, because these facts are attached to the run event.	none

The inputs above are this guardrail's own inputs, passed straight through to the collector. Setting one in buildnote.json changes what is collected, and two guardrails configured the same way share a single collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "checks": [
          {
              "use": "secrets/detector-ran@v1",
              "severity": "error",
              "with": {},
              "exemptions": []
          }
      ]
  }
}

How to fix

Run a secret detector in the pipeline and leave its report in the checkout before buildnote guardrails runs, or install one on the runner and let the collector run it. Any of these works:

gitleaks detect --no-banner --redact --report-format sarif --report-path gitleaks.sarif
trufflehog filesystem . --json > trufflehog.json
detect-secrets scan > .secrets.baseline

The guardrail reads whatever report it finds, so you can use any detector. A missing report is the violation, and that is why this guardrail exists: secrets/no-hardcoded-credentials skips when nothing scanned, so without this check, a repository nobody scans would report the same clean build as a repository with no secrets in it.

More in secrets

• secrets/gitignore-present. The repository has a .gitignore, so the next person who runs git add . doesn't commit build output or the local credential files next to it.
• secrets/no-credential-files-committed. None of the well-known credential files is in the working tree: no .env, private key, keystore, kubeconfig or cloud credential file.
• secrets/no-hardcoded-credentials. Every secret the detector reported is below the severity the team gates on, or matches a rule the team has already accepted.

All 4 secrets guardrails