git-secrets-scan:3.1.0 ignoring GITLEAKS_EXTRA_ARGS

Question

I'm trying to start using git-secrets-scan:3.1.0 pipe and the pipe appears to be ignoring the GITLEAKS_EXTRA_ARGS that is passed to it.

I have the following:

```yaml

- step: &SecurityScanname: Security Scanscript:- pipe: atlassian/git-secrets-scan:3.1.0variables:GITLEAKS_EXTRA_ARGS:- "--baseline-path=gitleaks-baseline-report.json"- "--platform=none"```When the step runs, none of the extra arguments appear to be passed to the gitleaks command, because the gitleaks run is ignoring my baseline file and still complains about unknown SCM platform.If I run the following locally, it runs fine:`gitleaks git --baseline-path=gitleaks-baseline-report.json --platform=none`

Paul S · Answer

BTW the scans were working fine for days - then failures across multiple repos with no changes made.

Paul S · Answer

Today I found that: Pipe has finished with an error: 126, Error: unknown flag: --max-decode-depth 3 while usage it outputs is: --max-decode-depth int allow recursive decoding up to this depth (default "0", no decoding is done) All this while trying to figure out why my scans are suddenly failing with: Traceback (most recent call last): File "/pipe.py", line 142, in pipe.run() File "/pipe.py", line 130, in run self.create_code_insights_report() File "/pipe.py", line 65, in create_code_insights_report report = insights.create_report(os.environ["BITBUCKET_COMMIT"], report_data=report_data) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/site-packages/bitbucket_pipes_toolkit/annotations.py", line 89, in create_report response.raise_for_status() File "/usr/lib/python3.11/site-packages/requests/models.py", line 1026, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 400 Client Error: Bad Request for url

Igor Stoyanov · Answer

Hi @John Alberts . Here i provided configuration:

- pipe: docker://bitbucketpipelines/git-secrets-scan:3.1.0
        variables:
          DEBUG: "true"
          GITLEAKS_EXTRA_ARGS:
              - "--verbose"
              - "--redact=100"
              - "--max-decode-depth=3"

And here is the output:

Try to add DEBUG to see gitleaks generated command.

Regards, Igor