Guardrails / secrets

No credential file in the checkout

secrets/no-credential-files-committed@v1

None of the well-known credential files is in the working tree: no .env, private key, keystore, kubeconfig or cloud credential file.

Id	secrets/no-credential-files-committed
Version	v1
Category	secrets
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	files

Collectors

This guardrail doesn't gather anything itself. It relies on the collectors below, which the CLI runs once per build before any check, and reads what they found from GUARDRAIL_FACTS. If a collector collects nothing, this guardrail is skipped, not failed.

Collector	Gathers	Inputs it is given
files	Presence, size and line counts of the well known files a repository is expected to carry, plus any extra path the guardrail asks for.	paths

The inputs above are this guardrail's own inputs, passed straight through to the collector. Setting one in buildnote.json changes what is collected, and two guardrails configured the same way share a single collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "checks": [
          {
              "use": "secrets/no-credential-files-committed@v1",
              "severity": "error",
              "with": {
                  "paths": ".env,.env.local,.env.development,.env.production,.env.test,id_rsa,id_dsa,id_ecdsa,id_ed25519,.npmrc,.netrc,kubeconfig,.kube/config,.aws/credentials,keystore.jks,keystore.p12,release.keystore"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
paths	Comma separated paths that must not be in the checkout, relative to the directory the CLI runs in. Use exact paths, not patterns: a pattern makes the guardrail skip instead of quietly passing, because the file facts it reads are looked up by path.	.env,.env.local,.env.development,.env.production,.env.test,id_rsa,id_dsa,id_ecdsa,id_ed25519,.npmrc,.netrc,kubeconfig,.kube/config,.aws/credentials,keystore.jks,keystore.p12,release.keystore	GUARDRAIL_INPUT_PATHS

How to fix

A .env file, private key or keystore in the working tree is one git add . away from the history, and once it's in the history it stays there. Remove it from the index, rotate whatever it contained, and ignore the path so it can't come back:

git rm --cached .env
printf '.env\n.env.*\nid_rsa\n*.pem\n*.jks\n' >> .gitignore

Keep the value in the runner's secret store and pass it to the process as an environment variable. If the pipeline needs the file, write it outside the checkout so it is never committed.

This guardrail checks exact paths, not patterns, because the file facts it reads are looked up by path. List the paths this repository could end up with:

{ "use": "secrets/no-credential-files-committed@v1", "with": { "paths": ".env,id_rsa,service-account.json" } }

Narrow the list the same way when a path is deliberately committed and holds no credential, such as an .npmrc that only contains registry configuration.

More in secrets

• secrets/detector-ran. A secret detector ran on the checkout, or left a report the build can be judged on, so something has actually looked for credentials.
• secrets/gitignore-present. The repository has a .gitignore, so the next person who runs git add . doesn't commit build output or the local credential files next to it.
• secrets/no-hardcoded-credentials. Every secret the detector reported is below the severity the team gates on, or matches a rule the team has already accepted.

All 4 secrets guardrails