git-secrets-scan:3.1.0 ignoring GITLEAKS_EXTRA_ARGS

[John Alberts]

I'm trying to start using git-secrets-scan:3.1.0 pipe and the pipe appears to be ignoring the GITLEAKS_EXTRA_ARGS that is passed to it.

I have the following:

```yaml

- step: &SecurityScan

name: Security Scan

script:

- pipe: atlassian/git-secrets-scan:3.1.0

variables:

GITLEAKS_EXTRA_ARGS:

- "--baseline-path=gitleaks-baseline-report.json"

- "--platform=none"

```

When the step runs, none of the extra arguments appear to be passed to the gitleaks command, because the gitleaks run is ignoring my baseline file and still complains about unknown SCM platform.

If I run the following locally, it runs fine:

`gitleaks git --baseline-path=gitleaks-baseline-report.json --platform=none`

[Igor Stoyanov]

Hi @John Alberts . Here i provided configuration:

      - pipe: docker://bitbucketpipelines/git-secrets-scan:3.1.0
        variables:
          DEBUG: "true"
          GITLEAKS_EXTRA_ARGS:
              - "--verbose"
              - "--redact=100"
              - "--max-decode-depth=3"

 And here is the output:

Try to add DEBUG to see gitleaks generated command.

Regards, Igor

[Paul S]

Today I found that:

Pipe has finished with an error: 126, Error: unknown flag: --max-decode-depth 3

while usage it outputs is:

--max-decode-depth int                    allow recursive decoding up to this depth (default "0", no decoding is done)

All this while trying to figure out why my scans are suddenly failing with:

Traceback (most recent call last):

File "/pipe.py", line 142, in <module>

pipe.run()

File "/pipe.py", line 130, in run

self.create_code_insights_report()

File "/pipe.py", line 65, in create_code_insights_report

report = insights.create_report(os.environ["BITBUCKET_COMMIT"], report_data=report_data)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/usr/lib/python3.11/site-packages/bitbucket_pipes_toolkit/annotations.py", line 89, in create_report

response.raise_for_status()

File "/usr/lib/python3.11/site-packages/requests/models.py", line 1026, in raise_for_status

raise HTTPError(http_error_msg, response=self)

requests.exceptions.HTTPError: 400 Client Error: Bad Request for url

[Paul S]

BTW the scans were working fine for days - then failures across multiple repos with no changes made.

[Ben]

Hi John,

I've reached out to our pipes team for further assistance on this. They should respond shortly.

Cheers!

- Ben (Bitbucket Cloud Support)