Guardrails / secrets

Repository ignores what it must not commit

secrets/gitignore-present@v1

The repository carries a .gitignore, so build output and the local credential files beside it are not committed by the next person who runs git add ..

Id	secrets/gitignore-present
Version	v1
Category	secrets
Default severity	warning
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	files

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
files	Presence, size and line counts of the well known files a repository is expected to carry, plus any extra path the guardrail asks for.	path

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "secrets/gitignore-present@v1",
              "severity": "warning",
              "with": {
                  "path": ".gitignore",
                  "minLines": "1"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
path	Path to the ignore file, relative to the directory the CLI runs in.	.gitignore	GUARDRAIL_INPUT_PATH
minLines	How many non-blank lines it must have before it counts as written.	1	GUARDRAIL_INPUT_MINLINES

How to fix

Add a .gitignore at the repository root covering build output and local configuration:

build/
.gradle/
node_modules/
.env
*.pem

Start from github/gitignore for the language and add what this repository writes. Without one, git add . stages whatever the last build and the last terraform apply left in the tree, which is how a .env and a private key reach a remote in the first place.

More in secrets

• secrets/detector-ran. A secret detector ran, or left a report the build can be judged on, rather than nothing having looked for a credential at all.
• secrets/no-credential-files-committed. None of the well known credential files is in the working tree: no .env, no private key, no keystore, no kubeconfig and no cloud credential file.
• secrets/no-hardcoded-credentials. Every secret the detector reported sits below the severity the team gates on, or is a rule the team has already accepted.

All 4 secrets guardrails