Repository navigation
Spell the scanner keys the way ggshield reads them - #30
Merged
Merged
Conversation
This file carried `ignored-matches` and `show-secrets`. ggshield reads `ignored_matches` and `show_secrets`; a hyphenated key is not an alias. It parses as valid YAML, is simply not a key ggshield looks for, and the exemption it describes never applies — with no warning, because an unknown key is not an error. So all six placeholder exemptions added in #10 have been inert since 2026-09-17. Nothing surfaced it: the envkit_canary() change keeps new commits off the assignment-line shape the detector matches, so the exemptions were never the thing holding the scan green. The estate-wide pass in #23 converted `ignored-paths` to `ignored_paths` here and in 26 other configs, but could not know about the two keys only this file has. This file was the last hyphenated one in either org. Canonical spelling confirmed against GitGuardian's own configuration docs and ggshield's `.gitguardian.example.yml`, both of which use underscores throughout. The trap is recorded in the file so the next reader does not "tidy" it back.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This file carried
ignored-matchesandshow-secrets. ggshield readsignored_matchesandshow_secrets— a hyphenated key is not an alias. It parses as valid YAML, is simply not a key ggshield looks for, and the exemption it describes never applies, with no warning, because an unknown key is not an error.So the six placeholder exemptions added in #10 have been inert since 2026-09-17.
Why nothing surfaced it
envkit_canary()keeps new commits off theSOMETHING_PASSWORD=<literal>shape the detector matches, so the exemptions were never the thing holding the scan green. A dead exemption and a working one look identical from the outside.The estate-wide pass in #23 converted
ignored-pathstoignored_pathshere and in 26 other configs, but could not know about the two keys only this file has. Measured across both in-scope orgs, this was the last hyphenated key in either — 27 configs use the underscored spelling.How the spelling was settled
GitGuardian's own configuration docs and ggshield's
.gitguardian.example.ymlboth use underscores throughout (ignored_paths,ignored_matches,show_secrets,ignored_detectors). No hyphenated alias is documented.Also in this change
A note in the file recording that the spelling is underscored and silently so, with the dates it was wrong, so the next reader does not tidy it back. The
ignored_pathsentry added in #23 gets one line saying why a path glob is right fortests/Fixtures/**specifically — generated fixture data, no literal to name.No code changes;
laranail-pint --testpasses.