detect-secrets, A Planted Key Found By The Scan, Refused By The Hook

detect-secrets

The Yelp CLI (detect-secrets) on EL 10, pinned to a version, in a virtual environment of its own with a link in the PATH. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package; the documented install is pip. EL 10 carries no detect-secrets, and pip install into the system Python ties the CLI's dependencies to whatever the OS ships. This role puts the CLI in /opt/detect-secrets, a venv apart from the system Python: an OS update cannot break it, and it cannot break the OS. The live test asserts import detect_secrets fails in /usr/bin/python3.

Pinned, and checked for consistency. detect_secrets_version is what gets installed; the live test runs pip check inside the venv and expects no broken requirements.

pip verifies nothing beyond TLS. The index is PyPI over HTTPS; there is no signature to check. For a byte-for-byte pin, give detect_secrets_pip_extra_args a requirements file with hashes and --require-hashes, or a private index.

Proven to run. The live test calls detect-secrets scan creds.txt and expects "AWS Access Key" - the whole tree loaded and the secret scanner did its work.

A planted key found by the scan and refused by the hook. The live test writes a file with an AWS-shaped access key (a made-up AKIA... value, not a credential) and a hex secret; detect-secrets scan is expected to report "AWS Access Key", detect-secrets-hook to exit 1 with "Potential secrets about to be committed", and the hook to exit 0 on a clean file. The hook is what a pre-commit configuration calls; the pre-commit role in this catalogue runs it.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.