Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

secretlint documentation bug re: no .secretlintignore file #3328

Closed
KlfJoat opened this issue Jan 25, 2024 · 5 comments · Fixed by #3476
Closed

secretlint documentation bug re: no .secretlintignore file #3328

KlfJoat opened this issue Jan 25, 2024 · 5 comments · Fixed by #3476
Labels
bug Something isn't working

Comments

@KlfJoat
Copy link

KlfJoat commented Jan 25, 2024

Describe the bug
I was wondering about the behavior of secretlint and looked at #2992. It led me to see that there is a difference between implementation and documentation.

The documentation at https://megalinter.io/latest/descriptors/repository_secretlint/ says:

See How to ignore files and directories with secretlint
If custom .secretlintignore ignore file is not found, .secretlintignore will be used

Expected behavior
To me, this implies that if I do not configure a .secretlintignore file, then a default one will be generated on the fly with the same contents as at that link, then the file will be discarded.

Actual behavior
However, the actual code shows that if a custom .secretlintignore file is not found, then .gitignore will be used, not a default.

Desired outcome
Update the documentation to match the implementation.

@KlfJoat KlfJoat added the bug Something isn't working label Jan 25, 2024
@nvuillam
Copy link
Member

Default .secreetlintignire that is shipped with MegaLinter image is not .gitignore but a default file containing megalinter-reports :)

https://github.com/oxsecurity/megalinter/blob/main/TEMPLATES/.secretlintignore

@pjungermann
Copy link
Contributor

@nvuillam As far as I got the description above and the code, the issue is that when I have no .secretlintignore locally, it will not use the default .secretlintignore shipped with the MegaLinter image/from the TEMPLATES dir but tries to use a local .gitignore instead.

The default .secretlintignore only contains

megalinter-reports

which is likely part of .gitignore files in repos anyway.
Also, using it would likely result in .gitignore-ed files not to be excluded anymore.

To me, it could make sense

  • to adjust the documentation to state the actual behavior,
  • and to remove the file from the TEMPLATES/ dir.

Copy link
Contributor

This issue has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.
Thank you for your contributions.

If you think this issue should stay open, please remove the O: stale 🤖 label or comment on the issue.

@github-actions github-actions bot added the O: stale 🤖 This issue or pull request is stale, it will be closed if there is no activity label Mar 25, 2024
@nvuillam
Copy link
Member

@pjungermann sorry for the delay (very long days at work ^^)

I agree with your solution, would you like to make a PR ? :)

@github-actions github-actions bot removed the O: stale 🤖 This issue or pull request is stale, it will be closed if there is no activity label Mar 27, 2024
@pjungermann
Copy link
Contributor

FYI: relates to #1207

pjungermann added a commit to pjungermann/megalinter that referenced this issue Apr 8, 2024
Removes the default `.secretlintignore`
that was actually never applied.

If `.secretlintignore` is absent,
`.gitignore` is used instead.

Removing this default config will adjust
the misleading documentation as well.

Fixes oxsecurity#3328
pjungermann added a commit to pjungermann/megalinter that referenced this issue Apr 8, 2024
Removes the default `.secretlintignore`
that was actually never applied.

If `.secretlintignore` is absent,
`.gitignore` is used instead.

Removing this default config will adjust
the misleading documentation as well.

Fixes oxsecurity#3328
pjungermann added a commit to pjungermann/megalinter that referenced this issue Apr 15, 2024
Removes the default `.secretlintignore`
that was actually never applied.

If `.secretlintignore` is absent,
`.gitignore` is used instead.

Removing this default config will adjust
the misleading documentation as well.

Fixes oxsecurity#3328
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants