Add .NET packages.lock.json to is_lock_file filter #593
Conversation
|
Hi @Pikabanga, thank you for opening this PR. I appreciate your work on improving detect-secrets. I ran our tests and it looks like they're failing, so I encourage you to take a look at those before we review your code. Let me know if you have any questions. |
The error is from a linter in files that I haven't touched... But I can fix them if you want :) |
|
@Pikabanga, thank you for that! Could you please add the E275 fix as part of a separate PR? It would allow us to push that sooner, without having to push everything else you added in here. |
|
@lorenzodb1 sure, here it is #598 |
|
Is this good to merge now? :) |
.NET supports lock files for Nuget packages since a few years ago, see https://devblogs.microsoft.com/nuget/enable-repeatable-package-restores-using-a-lock-file/
Without this filter detect-secrets flags a bunch of content hashes with the "Base64HighEntropyString" plugin.
Adding this file name to the filter removes the need for manually excluding these files (
detect-secrets scan --exclude-files "packages\.lock\.json" > .secrets.baseline)