secretlint

secretlint documentation

Version in MegaLinter: 4.1.0
Visit Official Web Site
See How to configure secretlint rules
- If custom .secretlintrc.json config file is not found, .secretlintrc.json will be used
See Index of problems detected by secretlint

Configuration in MegaLinter

Enable secretlint by adding REPOSITORY_SECRETLINT in ENABLE_LINTERS variable
Disable secretlint by adding REPOSITORY_SECRETLINT in DISABLE_LINTERS variable

Variable	Description	Default value
REPOSITORY_SECRETLINT_ARGUMENTS	User custom arguments to add in linter CLI call Ex: `-s --foo "bar"`
REPOSITORY_SECRETLINT_FILE_EXTENSIONS	Allowed file extensions. `"*"` matches any extension, `""` matches empty extension. Empty list excludes all files Ex: `[".py", ""]`	Exclude every file
REPOSITORY_SECRETLINT_FILE_NAMES_REGEX	File name regex filters. Regular expression list for filtering files by their base names using regex full match. Empty list includes all files Ex: `["Dockerfile(-.+)?", "Jenkinsfile"]`	Include every file
REPOSITORY_SECRETLINT_PRE_COMMANDS	List of bash commands to run before the linter	None
REPOSITORY_SECRETLINT_POST_COMMANDS	List of bash commands to run after the linter	None
REPOSITORY_SECRETLINT_CONFIG_FILE	secretlint configuration file name Use `LINTER_DEFAULT` to let the linter find it	`.secretlintrc.json`
REPOSITORY_SECRETLINT_RULES_PATH	Path where to find linter configuration file	Workspace folder, then MegaLinter default rules
REPOSITORY_SECRETLINT_DISABLE_ERRORS	Run linter but consider errors as warnings	`false`
REPOSITORY_SECRETLINT_DISABLE_ERRORS_IF_LESS_THAN	Maximum number of errors allowed	`0`

MegaLinter Flavours

This linter is available in the following flavours

Flavor	Description	Embedded linters
all	Default MegaLinter Flavor	101
ci_light	Optimized for CI items (Dockerfile, Jenkinsfile, JSON/YAML schemas,XML	18
documentation	MegaLinter for documentation projects	42
dotnet	Optimized for C, C++, C# or VB based projects	50
go	Optimized for GO based projects	44
java	Optimized for JAVA based projects	44
javascript	Optimized for JAVASCRIPT or TYPESCRIPT based projects	51
php	Optimized for PHP based projects	46
python	Optimized for PYTHON based projects	50
ruby	Optimized for RUBY based projects	43
rust	Optimized for RUST based projects	43
salesforce	Optimized for Salesforce based projects	45
security	Optimized for security	20
swift	Optimized for SWIFT based projects	43
terraform	Optimized for TERRAFORM based projects	48

Behind the scenes

How are identified applicable files

If this linter is active, all files will always be linted

How the linting is performed

secretlint is called once on the whole project directory

filtering can not be done using MegaLinter configuration variables,it must be done using secretlint configuration or ignore file (if existing)
VALIDATE_ALL_CODEBASE: false does not make secretlint analyze only updated files

Example calls

secretlint "*/**"

secretlint --secretlintrc .secretlintrc.json "**/*"

Help content


  Secretlint CLI that scan secret/credential data.

  Usage
    $ secretlint [file|glob*]

  Note
    supported glob syntax is based on microglob
    https://github.com/micromatch/micromatch#matching-features

  Options
    --init             setup config file. Create .secretlintrc.json file from your package.json
    --format           [String] formatter name. Default: "stylish". Available Formatter: checkstyle, compact, jslint-xml, json, junit, pretty-error, stylish, tap, unix, table.d, table
    --output           [path:String] output file path that is written of reported result.
    --no-color         disable ANSI-color of output.
    --no-terminalLink  disable terminalLink of output.
    --maskSecrets      enable masking of secret values. replace actual secrets with "***".
    --secretlintrc     [path:String] path to .secretlintrc config file. Default: .secretlintrc.*
    --secretlintignore [path:String] path to .secretlintignore file. Default: .secretlintignore

  Options for Developer
    --profile          Enable performance profile.
    --secretlintrcJSON [String] a JSON string of .secretlintrc. use JSON string instead of rc file.

  Experimental Options
    --locale            [String] locale tag for translating message. Default: en

  Examples
    $ secretlint ./README.md
    # glob pattern should be wrapped with double quote
    $ secretlint "**/*"
    $ secretlint "source/**/*.ini"

Installation on mega-linter Docker image

NPM packages (node.js):