detect-secrets icon indicating copy to clipboard operation
detect-secrets copied to clipboard

[enhancement] Allow setting DETECT_SECRETS_SECURITY_TEAM via a command-line argument

Open ExplodingCabbage opened this issue 4 years ago • 1 comments

In https://github.com/Yelp/detect-secrets/pull/283, @0atman added the DETECT_SECRETS_SECURITY_TEAM environment variable. Trouble is, it's hard to set environment variables via pre-commit (and pre-commit is one of the officially suggested ways of running detect-secrets, per the README). As far as I've been able to find, pre-commit has no support at all for configuring environment variables in pre-commit.yaml, and you have to resort to a hack like overriding the hook's entry in pre-commit.yaml to be something like

env DETECT_SECRETS_SECURITY_TEAM='in #infosec' detect-secrets-hook

which is a bit ugly and more importantly isn't a trivial workaround to come up with - you need to have at least a little bit of knowledge of how pre-commit works to even know that entry: is a thing and that it's possible to override it, and then you need to look into this repo to discover that the default entry is the detect-secrets-hook executable, and you need to have sufficient unix knowledge to know that you can use env to run another program with added environment variables.

It'd probably be easier for people to use this feature if there were also a --security-team command-line argument that could be used instead, rather than setting an environment variable being the only way.

ExplodingCabbage avatar Mar 22 '21 13:03 ExplodingCabbage

Yeah, we were wrapping pre-commit in our own python script, setting the env there. We've since stopped using our custom wrapper and gone back to vanilla pre-commit, so we'd have the same annoyances as you have outlined.

0atman avatar Mar 22 '21 14:03 0atman