Skip to content
rlsbl.secret_scan
Updated
On this page

Pre-publish secret scan gate using gitleaks that scans built artifacts for leaked secrets before any push or publish step in the release flow.

#rlsbl.secret_scan

#rlsbl.secret_scan

Pre-publish secret scan gate using gitleaks that scans built artifacts for leaked secrets before any push or publish step in the release flow.

Scans built artifacts (wheels, tarballs, archives) for leaked secrets before any push or publish step. This is a hard, non-bypassable gate in the release flow.

#SecretScanError

Raised when gitleaks finds secrets in built artifacts.

#_require_gitleaks

python
def _require_gitleaks()

Ensure gitleaks is available. Hard error with install instructions if missing.

#_find_artifacts

python
def _find_artifacts(project_dir, target_paths=None)

Discover built artifacts in dist/ under the project directory.

When target_paths is provided (a dict or iterable of paths), each target's dist/ is scanned independently so that subdirectory targets' artifacts are found even when the project root has no dist/ of its own. The project root's dist/ is always included (deduped by absolute path).

Returns a list of absolute paths to scannable archive files (.whl, .tar.gz, .tgz, .zip).

#_dist_dirs

python
def _dist_dirs(project_dir, target_paths=None)

Collect the dist/ directories to scan/clean.

Always includes the project root's dist/. When target_paths is provided (a dict or iterable of paths), each target's dist/ is added too (deduped by absolute path), so subdirectory targets are covered.

#clean_stale_artifacts

python
def clean_stale_artifacts(project_dir, log=None, target_paths=None)

Remove pre-existing build artifacts from dist/ before a fresh build.

Build tools (e.g. uv build, npm pack) write new artifacts into dist/ without removing older ones, so artifacts from previous versions accumulate. The secret scan would then scan artifacts that are not part of the current release -- stale files that could carry old secrets or slow the scan. Clearing matching artifact files before the build scopes the subsequent scan to exactly what this release produces.

This uses a temporal clean (option (a)) rather than version-string filtering because version-in-filename conventions are unreliable across ecosystems: wheels normalize versions per PEP 440 (1.0.0-rc1 -> 1.0.0rc1) and package names (my-pkg -> my_pkg), npm scoped packages embed the scope, etc. Matching a raw version string against these filenames would miss or mis-match. Removing all artifacts before the build and letting the build repopulate dist/ is robust for every ecosystem.

Only files matching the artifact glob patterns are removed -- never other dist/ contents. Each removed file is reported via log. This is normal runtime tool behavior (not user data), so plain os.remove is used rather than saferm.

When target_paths is provided (a dict or iterable of paths), each target's dist/ is cleaned in addition to the project root's dist/, so subdirectory targets' stale artifacts are scoped out before the scan (mirroring how :func:scan_artifacts_for_secrets discovers them).

Returns the list of absolute paths that were removed.

#_unpack_artifact

python
def _unpack_artifact(artifact_path, dest_dir)

Unpack a single artifact into dest_dir.

Handles .whl/.zip (zip archives) and .tar.gz/.tgz (tar archives).

#_run_gitleaks

python
def _run_gitleaks(scan_dir, config_path=None)

Run gitleaks on a directory. Returns (exit_code, stdout, stderr).

Uses gitleaks dir which scans files directly (no git history).

#scan_artifacts_for_secrets

python
def scan_artifacts_for_secrets(project_dir, log=None, target_paths=None)

Scan all built artifacts in dist/ for leaked secrets.

This is a hard gate: if gitleaks finds any secrets, the release is aborted. There is no bypass flag.

Args:

  • project_dir: path to the project root (dist/ is expected here).
  • log: optional callable for status messages.
  • target_paths: optional dict (or iterable of paths) mapping target

names to directory paths. When provided, each target's dist/ is scanned in addition to the project root's dist/, so subdirectory targets' artifacts are covered.

Raises:

  • FileNotFoundError: if gitleaks is not installed.
  • SecretScanError: if secrets are found in any artifact.

More tools from this site

  • claudestream Drive Claude Code from Python: run it as a subprocess and read its output as typed events, with async and sync sessions, sandbox policies, and tools you define in Python
  • claudewheel A TUI Claude Code Launcher that lets you have more than one profile, manage sessions lifecycle, pick the exact CC version, model to use (even older unlisted ones), pick which GitHub account to use, etc.
  • dirstat Fast, single-binary directory statistics CLI: every file under a tree grouped by format, with counts, sizes, and lines of code, as a colored terminal table or as JSON
  • fastware A batteries-included ASGI framework: msgspec JSON, a managed Granian server, dependency injection, SSE, WebSockets, auth, and a test client
  • go-toml-edit Zero-dep TOML editing library for Go with comment preservation
  • howmuchleft The fastest Claude Code statusline: context window, 5-hour, and weekly limit usage as three customizable gradient bars, rendering in about 6 ms
  • orxtra
  • pgdesign
  • predraw Declarative rendering pipeline: describe a scene in JSON and get SVG, PNG and WebP out, with light and dark style tokens, reusable components and text converted to path outlines
  • reposummary Turn a git repository's history into a Markdown journal: pick a time window or revision range and get a readable digest of what changed, optionally narrated by an LLM
  • safegit git wrapper CLI that gives each commit its own temporary index and retries ref updates on conflict, so concurrent agents share one repository
  • saferm Command-line replacement for rm that archives every deletion with a mandatory reason and the context it ran in, so deleted files can be listed, inspected and restored
  • selfdoc Static Site Generator that builds a project's documentation site directly from its source code, so the docs can never drift from the code they describe, with SEO/AEO, first-class blog, search, and cross-project linking built in
  • strictcli
  • stricttest An always-on test-isolation floor: a pytest plugin and a Go env-hygiene module that make a test suite structurally unable to reach real credentials, the real HOME, the network, or the development repository.
  • wesktop A Python framework that turns an ASGI web app into a desktop application, serving it from a local Granian server and displaying it in a native OS window via pywebview
Search