Skip to content

Commit d901f16

Browse files
agateau-ggagateau-gg
authored
Merge pull request #1060 from GitGuardian/agateau/prepare-release
Prepare release
2 parents 0427991 + a45cfc1 commit d901f16

16 files changed

+756
-90
lines changed

‎scripts/release

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -203,24 +203,27 @@ def run_tests() -> None:
203203
if "GITGUARDIAN_API_KEY" not in os.environ:
204204
fail("Environment variable $GITGUARDIAN_API_KEY is not set")
205205

206-
# If CASSETTES_DIR does not exist, tests fail, so recreate it
207-
log_progress("Removing cassettes")
208-
shutil.rmtree(CASSETTES_DIR)
209-
CASSETTES_DIR.mkdir()
210-
211-
# Start the hashicorp Vault server for HMSL tests
212-
start_hashicorp_vault_server()
213-
214-
log_progress("Running unit tests")
215-
check_run(["pytest", "tests/unit"], cwd=ROOT_DIR)
216-
217-
log_progress("Running functional tests")
218-
check_run(["pytest", "tests/functional"], cwd=ROOT_DIR)
219-
220-
log_progress("Restoring cassettes")
221-
check_run(["git", "restore", CASSETTES_DIR], cwd=ROOT_DIR)
222-
223-
stop_hashicorp_vault_server()
206+
try:
207+
# If CASSETTES_DIR does not exist, tests fail, so recreate it
208+
log_progress("Removing cassettes")
209+
shutil.rmtree(CASSETTES_DIR)
210+
CASSETTES_DIR.mkdir()
211+
212+
# Start the hashicorp Vault server for HMSL tests
213+
log_progress("Starting Hashicorp server for HMSL tests")
214+
start_hashicorp_vault_server()
215+
216+
log_progress("Running unit tests")
217+
check_run(["pytest", "tests/unit"], cwd=ROOT_DIR)
218+
219+
log_progress("Running functional tests")
220+
check_run(["pytest", "tests/functional"], cwd=ROOT_DIR)
221+
finally:
222+
log_progress("Restoring cassettes")
223+
check_run(["git", "restore", CASSETTES_DIR], cwd=ROOT_DIR)
224+
225+
log_progress("Stopping Hashicorp server")
226+
stop_hashicorp_vault_server()
224227

225228

226229
def replace_once_in_file(path: Path, src: str, dst: str, flags: int = 0) -> None:

‎tests/unit/cassettes/test_docker_scan_archive-False.yaml

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
interactions:
2+
- request:
3+
body: null
4+
headers:
5+
Accept:
6+
- '*/*'
7+
Accept-Encoding:
8+
- gzip, deflate
9+
Connection:
10+
- keep-alive
11+
User-Agent:
12+
- pygitguardian/1.20.0 (Linux;py3.11.8) ggshield
13+
method: GET
14+
uri: https://api.gitguardian.com/v1/metadata
15+
response:
16+
body:
17+
string:
18+
'{"version":"v2.158.0","preferences":{"marketplaces__aws_product_url":"http://aws.amazon.com/marketplace/pp/prodview-mrmulzykamba6","on_premise__restrict_signup":true,"on_premise__is_email_server_configured":true,"on_premise__default_sso_config_api_id":null,"on_premise__default_sso_config_force_sso":null,"onboarding__segmentation_v1_enabled":true,"general__maximum_payload_size":26214400,"general__mutual_tls_mode":"disabled","general__signup_enabled":true},"secret_scan_preferences":{"maximum_documents_per_scan":20,"maximum_document_size":1048576},"remediation_messages":{"pre_commit":">
19+
How to remediate\n\n Since the secret was detected before the commit was
20+
made:\n 1. replace the secret with its reference (e.g. environment variable).\n 2.
21+
commit again.\n\n> [To apply with caution] If you want to bypass ggshield
22+
(false positive or other reason), run:\n - if you use the pre-commit framework:\n\n SKIP=ggshield
23+
git commit -m \"<your message\"","pre_push":"> How to remediate\n\n Since
24+
the secret was detected before the push BUT after the commit, you need to:\n 1.
25+
rewrite the git history making sure to replace the secret with its reference
26+
(e.g. environment variable).\n 2. push again.\n\n To prevent having to rewrite
27+
git history in the future, setup ggshield as a pre-commit hook:\n https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit\n\n>
28+
[Apply with caution] If you want to bypass ggshield (false positive or other
29+
reason), run:\n - if you use the pre-commit framework:\n\n SKIP=ggshield-push
30+
git push","pre_receive":"> How to remediate\n\n A pre-receive hook set server
31+
side prevented you from pushing secrets.\n\n Since the secret was detected
32+
during the push BUT after the commit, you need to:\n 1. rewrite the git history
33+
making sure to replace the secret with its reference (e.g. environment variable).\n 2.
34+
push again.\n\n To prevent having to rewrite git history in the future, setup
35+
ggshield as a pre-commit hook:\n https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit\n\n>
36+
[Apply with caution] If you want to bypass ggshield (false positive or other
37+
reason), run:\n\n git push -o breakglass"}}'
38+
headers:
39+
access-control-expose-headers:
40+
- X-App-Version
41+
allow:
42+
- GET, HEAD, OPTIONS
43+
content-length:
44+
- '2194'
45+
content-type:
46+
- application/json
47+
cross-origin-opener-policy:
48+
- same-origin
49+
date:
50+
- Thu, 27 Feb 2025 15:34:58 GMT
51+
referrer-policy:
52+
- strict-origin-when-cross-origin
53+
server:
54+
- istio-envoy
55+
strict-transport-security:
56+
- max-age=31536000; includeSubDomains
57+
transfer-encoding:
58+
- chunked
59+
vary:
60+
- Accept-Encoding,Cookie
61+
x-app-version:
62+
- v2.158.0
63+
x-content-type-options:
64+
- nosniff
65+
- nosniff
66+
x-envoy-upstream-service-time:
67+
- '41'
68+
x-frame-options:
69+
- DENY
70+
- SAMEORIGIN
71+
x-secrets-engine-version:
72+
- 2.133.0
73+
x-xss-protection:
74+
- 1; mode=block
75+
status:
76+
code: 200
77+
message: OK
78+
- request:
79+
body:
80+
'[{"filename": "file_secret", "document": "commit 9537b6343a81f88d471e93f20ffb2e2665bbab00\nAuthor:
81+
GitGuardian Owl <[email protected]>\nDate: Thu Aug 18 18:20:21 2022 +0200\n\nA
82+
message\n\n:000000 100644 0000000 e965047 A\u001atest\u001a\u001adiff --git
83+
a/test b/test\nnew file mode 100644\nindex 0000000..b80e3df\n--- /dev/null\n+++
84+
b/test\n@@ -0,0 +2 @@\n+# gg token\n+apikey = \"8a784aab7090f6a4ba3b9f7a6594e2e727007a26590b58ed314e4b9ed4536479sRZlRup3xvtMVfiHWAanbe712Jtc3nY8veZux5raL1bhpaxiv0rfyhFoAIMZUCh2Njyk7gRVsSQFPrEphSJnxa16SIdWKb03sRft770LUTTYTAy3IM18A7Su4HjiHlGA9ihLj9ou3luadfRAATlKH6kAZwTw289Kq9uip67zxyWkUJdh6PTeFpMgCh3AhHcZ21VeZHlu12345\";\n"}]'
85+
headers:
86+
Accept:
87+
- '*/*'
88+
Accept-Encoding:
89+
- gzip, deflate
90+
Connection:
91+
- keep-alive
92+
Content-Length:
93+
- '659'
94+
Content-Type:
95+
- application/json
96+
GGShield-Command-Id:
97+
- 0f674b05-3a26-45ea-8a1c-1229fc77b1bc
98+
GGShield-Command-Path:
99+
- cli secret scan docker-archive
100+
GGShield-OS-Name:
101+
- ubuntu
102+
GGShield-OS-Version:
103+
- '22.04'
104+
GGShield-Python-Version:
105+
- 3.11.8
106+
GGShield-Version:
107+
- 1.36.0
108+
User-Agent:
109+
- pygitguardian/1.20.0 (Linux;py3.11.8) ggshield
110+
mode:
111+
- docker
112+
scan_options:
113+
- '{"show_secrets": false, "ignored_detectors_count": 0, "ignored_matches_count":
114+
0, "ignored_paths_count": 14, "ignore_known_secrets": false, "with_incident_details":
115+
false, "has_prereceive_remediation_message": false, "all_secrets": false}'
116+
method: POST
117+
uri: https://api.gitguardian.com/v1/multiscan?all_secrets=True
118+
response:
119+
body:
120+
string:
121+
'[{"policy_break_count":1,"policies":["Secrets detection"],"policy_breaks":[{"type":"GitGuardian
122+
Development Secret","policy":"Secrets detection","matches":[{"type":"apikey","match":"8a784aab7090f6a4ba3b9f7a6594e2e727007a26590b58ed314e4b9ed4536479sRZlRup3xvtMVfiHWAanbe712Jtc3nY8veZux5raL1bhpaxiv0rfyhFoAIMZUCh2Njyk7gRVsSQFPrEphSJnxa16SIdWKb03sRft770LUTTYTAy3IM18A7Su4HjiHlGA9ihLj9ou3luadfRAATlKH6kAZwTw289Kq9uip67zxyWkUJdh6PTeFpMgCh3AhHcZ21VeZHlu12345","index_start":311,"index_end":579,"line_start":14,"line_end":14}],"is_excluded":false,"exclude_reason":null,"incident_url":"https://dashboard.gitguardian.com/workspace/8/incidents/8137386","known_secret":true,"validity":"no_checker","diff_kind":null}],"is_diff":false}]'
123+
headers:
124+
access-control-expose-headers:
125+
- X-App-Version
126+
allow:
127+
- POST, OPTIONS
128+
content-length:
129+
- '722'
130+
content-type:
131+
- application/json
132+
cross-origin-opener-policy:
133+
- same-origin
134+
date:
135+
- Thu, 27 Feb 2025 15:34:59 GMT
136+
referrer-policy:
137+
- strict-origin-when-cross-origin
138+
server:
139+
- istio-envoy
140+
strict-transport-security:
141+
- max-age=31536000; includeSubDomains
142+
vary:
143+
- Cookie
144+
x-app-version:
145+
- v2.158.0
146+
x-content-type-options:
147+
- nosniff
148+
- nosniff
149+
x-envoy-upstream-service-time:
150+
- '442'
151+
x-frame-options:
152+
- DENY
153+
- SAMEORIGIN
154+
x-secrets-engine-version:
155+
- 2.133.0
156+
x-xss-protection:
157+
- 1; mode=block
158+
status:
159+
code: 200
160+
message: OK
161+
version: 1

‎tests/unit/cassettes/test_docker_scan_archive-True.yaml

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
interactions:
2+
- request:
3+
body: null
4+
headers:
5+
Accept:
6+
- '*/*'
7+
Accept-Encoding:
8+
- gzip, deflate
9+
Connection:
10+
- keep-alive
11+
User-Agent:
12+
- pygitguardian/1.20.0 (Linux;py3.11.8) ggshield
13+
method: GET
14+
uri: https://api.gitguardian.com/v1/metadata
15+
response:
16+
body:
17+
string:
18+
'{"version":"v2.158.0","preferences":{"marketplaces__aws_product_url":"http://aws.amazon.com/marketplace/pp/prodview-mrmulzykamba6","on_premise__restrict_signup":true,"on_premise__is_email_server_configured":true,"on_premise__default_sso_config_api_id":null,"on_premise__default_sso_config_force_sso":null,"onboarding__segmentation_v1_enabled":true,"general__maximum_payload_size":26214400,"general__mutual_tls_mode":"disabled","general__signup_enabled":true},"secret_scan_preferences":{"maximum_documents_per_scan":20,"maximum_document_size":1048576},"remediation_messages":{"pre_commit":">
19+
How to remediate\n\n Since the secret was detected before the commit was
20+
made:\n 1. replace the secret with its reference (e.g. environment variable).\n 2.
21+
commit again.\n\n> [To apply with caution] If you want to bypass ggshield
22+
(false positive or other reason), run:\n - if you use the pre-commit framework:\n\n SKIP=ggshield
23+
git commit -m \"<your message\"","pre_push":"> How to remediate\n\n Since
24+
the secret was detected before the push BUT after the commit, you need to:\n 1.
25+
rewrite the git history making sure to replace the secret with its reference
26+
(e.g. environment variable).\n 2. push again.\n\n To prevent having to rewrite
27+
git history in the future, setup ggshield as a pre-commit hook:\n https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit\n\n>
28+
[Apply with caution] If you want to bypass ggshield (false positive or other
29+
reason), run:\n - if you use the pre-commit framework:\n\n SKIP=ggshield-push
30+
git push","pre_receive":"> How to remediate\n\n A pre-receive hook set server
31+
side prevented you from pushing secrets.\n\n Since the secret was detected
32+
during the push BUT after the commit, you need to:\n 1. rewrite the git history
33+
making sure to replace the secret with its reference (e.g. environment variable).\n 2.
34+
push again.\n\n To prevent having to rewrite git history in the future, setup
35+
ggshield as a pre-commit hook:\n https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit\n\n>
36+
[Apply with caution] If you want to bypass ggshield (false positive or other
37+
reason), run:\n\n git push -o breakglass"}}'
38+
headers:
39+
access-control-expose-headers:
40+
- X-App-Version
41+
allow:
42+
- GET, HEAD, OPTIONS
43+
content-length:
44+
- '2194'
45+
content-type:
46+
- application/json
47+
cross-origin-opener-policy:
48+
- same-origin
49+
date:
50+
- Thu, 27 Feb 2025 15:34:57 GMT
51+
referrer-policy:
52+
- strict-origin-when-cross-origin
53+
server:
54+
- istio-envoy
55+
strict-transport-security:
56+
- max-age=31536000; includeSubDomains
57+
transfer-encoding:
58+
- chunked
59+
vary:
60+
- Accept-Encoding,Cookie
61+
x-app-version:
62+
- v2.158.0
63+
x-content-type-options:
64+
- nosniff
65+
- nosniff
66+
x-envoy-upstream-service-time:
67+
- '43'
68+
x-frame-options:
69+
- DENY
70+
- SAMEORIGIN
71+
x-secrets-engine-version:
72+
- 2.133.0
73+
x-xss-protection:
74+
- 1; mode=block
75+
status:
76+
code: 200
77+
message: OK
78+
version: 1

‎tests/unit/cassettes/test_hmsl_api_status.yaml

Lines changed: 62 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,62 @@
11
interactions:
2+
- request:
3+
body: '{"audience": "https://api.hasmysecretleaked.com", "audience_type": "hmsl"}'
4+
headers:
5+
Accept:
6+
- '*/*'
7+
Accept-Encoding:
8+
- gzip, deflate
9+
Connection:
10+
- keep-alive
11+
Content-Length:
12+
- '74'
13+
Content-Type:
14+
- application/json
15+
User-Agent:
16+
- pygitguardian/1.20.0 (Linux;py3.11.8) ggshield
17+
method: POST
18+
uri: https://api.gitguardian.com/v1/auth/jwt
19+
response:
20+
body:
21+
string: '{"token": "<REDACTED>"}'
22+
headers:
23+
access-control-expose-headers:
24+
- X-App-Version
25+
allow:
26+
- POST, OPTIONS
27+
content-length:
28+
- '741'
29+
content-type:
30+
- application/json
31+
cross-origin-opener-policy:
32+
- same-origin
33+
date:
34+
- Thu, 27 Feb 2025 17:20:28 GMT
35+
referrer-policy:
36+
- strict-origin-when-cross-origin
37+
server:
38+
- istio-envoy
39+
strict-transport-security:
40+
- max-age=31536000; includeSubDomains
41+
vary:
42+
- Cookie
43+
x-app-version:
44+
- v2.158.0
45+
x-content-type-options:
46+
- nosniff
47+
- nosniff
48+
x-envoy-upstream-service-time:
49+
- '68'
50+
x-frame-options:
51+
- DENY
52+
- SAMEORIGIN
53+
x-secrets-engine-version:
54+
- 2.133.0
55+
x-xss-protection:
56+
- 1; mode=block
57+
status:
58+
code: 200
59+
message: OK
260
- request:
361
body: null
462
headers:
@@ -11,7 +69,7 @@ interactions:
1169
GGShield-HMSL-Command-Name:
1270
- cli_hmsl_api-status
1371
User-Agent:
14-
- GGShield 1.21.0
72+
- GGShield 1.36.0
1573
method: GET
1674
uri: https://api.hasmysecretleaked.com/healthz
1775
response:
@@ -23,13 +81,13 @@ interactions:
2381
content-type:
2482
- application/json
2583
date:
26-
- Tue, 28 Nov 2023 09:00:15 GMT
84+
- Thu, 27 Feb 2025 17:20:28 GMT
2785
server:
2886
- istio-envoy
2987
x-app-version:
30-
- 1.9.0
88+
- 1.12.11
3189
x-envoy-upstream-service-time:
32-
- '6'
90+
- '4'
3391
status:
3492
code: 200
3593
message: OK

0 commit comments

Comments
 (0)