Guardrails / secrets

No credential file in the checkout

secrets/no-credential-files-committed@v1

None of the well known credential files is in the working tree: no .env, no private key, no keystore, no kubeconfig and no cloud credential file.

Id	secrets/no-credential-files-committed
Version	v1
Category	secrets
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	files

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
files	Presence, size and line counts of the well known files a repository is expected to carry, plus any extra path the guardrail asks for.	paths

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "secrets/no-credential-files-committed@v1",
              "severity": "error",
              "with": {
                  "paths": ".env,.env.local,.env.development,.env.production,.env.test,id_rsa,id_dsa,id_ecdsa,id_ed25519,.npmrc,.netrc,kubeconfig,.kube/config,.aws/credentials,keystore.jks,keystore.p12,release.keystore"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
paths	Comma separated paths that must not be in the checkout, relative to the directory the CLI runs in. Exact paths, not patterns: a pattern is a skip rather than a quiet pass, because the file facts this reads answer a path.	.env,.env.local,.env.development,.env.production,.env.test,id_rsa,id_dsa,id_ecdsa,id_ed25519,.npmrc,.netrc,kubeconfig,.kube/config,.aws/credentials,keystore.jks,keystore.p12,release.keystore	GUARDRAIL_INPUT_PATHS

How to fix

A .env, a private key or a keystore sitting in the working tree is one git add . away from the history, and the history is forever. Take it out of the index, rotate whatever it carried, and ignore the path so it cannot come back:

git rm --cached .env
printf '.env\n.env.*\nid_rsa\n*.pem\n*.jks\n' >> .gitignore

Keep the value in the runner's secret store and hand it to the process as an environment variable, so the file the pipeline needs is written outside the checkout and never committed.

This guardrail reads exact paths rather than patterns, because the file facts it is built on answer a path. Name the ones this repository can grow:

{ "use": "secrets/no-credential-files-committed@v1", "with": { "paths": ".env,id_rsa,service-account.json" } }

Narrow it the same way where a path is deliberately committed and carries no credential, such as an .npmrc holding only registry configuration.

More in secrets

• secrets/detector-ran. A secret detector ran, or left a report the build can be judged on, rather than nothing having looked for a credential at all.
• secrets/gitignore-present. The repository carries a .gitignore, so build output and the local credential files beside it are not committed by the next person who runs git add ..
• secrets/no-hardcoded-credentials. Every secret the detector reported sits below the severity the team gates on, or is a rule the team has already accepted.

All 4 secrets guardrails