Merge pull request #152 from openshift-cherrypick-robot/cherry-pick-1…

…50-to-release-4.6

[release-4.6] Add detect-secrets tooling

.pre-commit-config.yaml

@@ -0,0 +1,23 @@
+# NOTE(jonesbr): Copied copied from https://github.com/IBM/detect-secrets/blob/master/.pre-commit-config.yaml
+# This is an example configuration to enable detect-secrets in the pre-commit hook.
+# Add this file to the root folder of your repository.
+#
+# Read pre-commit hook framework https://pre-commit.com/ for more details about the structure of config yaml file and how git pre-commit would invoke each hook.
+#
+# This line indicates we will use the hook from ibm/detect-secrets to run scan during committing phase.
+# Whitewater/whitewater-detect-secrets would sync code to ibm/detect-secrets upon merge.
+repos:
+- repo: https://github.com/ibm/detect-secrets
+  # If you desire to use a specific version of detect-secrets, you can replace `master` with other git revisions such as branch, tag or commit sha.
+  # You are encouraged to use static refs such as tags, instead of branch name
+  #
+  # Running "pre-commit autoupdate" would automatically updates rev to latest tag
+  rev: 0.13.1+ibm.29.dss
+  hooks:
+  - id: detect-secrets # pragma: whitelist secret
+    # Add options for detect-secrets-hook binary. You can run `detect-secrets-hook --help` to list out all possible options.
+    # You may also run `pre-commit run detect-secrets` to preview the scan result.
+    # when "--baseline" without "--use-all-plugins", pre-commit scan with just plugins in baseline file
+    # when "--baseline" with "--use-all-plugins", pre-commit scan with all available plugins
+    # add "--fail-on-non-audited" to fail pre-commit for unaudited potential secrets
+    args: [--baseline, .secrets.baseline, --use-all-plugins ]

.secrets.baseline

@@ -0,0 +1,129 @@
+{
+  "exclude": {
+    "files": "vendor/*|go.sum|^.secrets.baseline$",
+    "lines": null
+  },
+  "generated_at": "2021-02-19T15:56:21Z",
+  "plugins_used": [
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "base64_limit": 4.5,
+      "name": "Base64HighEntropyString"
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "BoxDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "GheDetector"
+    },
+    {
+      "hex_limit": 3,
+      "name": "HexHighEntropyString"
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "keyword_exclude": null,
+      "name": "KeywordDetector"
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "results": {
+    "assets/oauth-openshift/oauth-browser-client.yaml": [
+      {
+        "hashed_secret": "d2e2ab0f407e4ee3cf2ab87d61c31b25a74085e5",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 14,
+        "type": "Secret Keyword",
+        "verified_result": null
+      }
+    ],
+    "assets/oauth-openshift/v4-0-config-system-branding.yaml": [
+      {
+        "hashed_secret": "aaa27c9c3a0567f94e8abc4e6e7ca0743e34e469",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 6,
+        "type": "Base64 High Entropy String",
+        "verified_result": null
+      },
+      {
+        "hashed_secret": "53f72a84dd36abdd3ce91dde04f889c41fff3cd5",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 7,
+        "type": "Base64 High Entropy String",
+        "verified_result": null
+      },
+      {
+        "hashed_secret": "ee09ba92af12aea914e2432169b757400d808a86",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 8,
+        "type": "Base64 High Entropy String",
+        "verified_result": null
+      }
+    ],
+    "cluster.yaml.example": [
+      {
+        "hashed_secret": "caa006e5e030a94b2be4abf9d333f029df7fa5fc",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 27,
+        "type": "Base64 High Entropy String",
+        "verified_result": null
+      }
+    ],
+    "pkg/assets/bindata.go": [
+      {
+        "hashed_secret": "d2e2ab0f407e4ee3cf2ab87d61c31b25a74085e5",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 2154,
+        "type": "Secret Keyword",
+        "verified_result": null
+      }
+    ]
+  },
+  "version": "0.13.1+ibm.29.dss",
+  "word_list": {
+    "file": null,
+    "hash": null
+  }
+}