From a2f5e5295adcd26e31c06073ee6d33d8baff24f1 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Sat, 7 Nov 2026 04:51:54 -0500 Subject: [PATCH] Spell the scanner keys the way ggshield reads them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This file carried `ignored-matches` and `show-secrets`. ggshield reads `ignored_matches` and `show_secrets`; a hyphenated key is not an alias. It parses as valid YAML, is simply not a key ggshield looks for, and the exemption it describes never applies — with no warning, because an unknown key is not an error. So all six placeholder exemptions added in #10 have been inert since 2026-09-17. Nothing surfaced it: the envkit_canary() change keeps new commits off the assignment-line shape the detector matches, so the exemptions were never the thing holding the scan green. The estate-wide pass in #23 converted `ignored-paths` to `ignored_paths` here and in 26 other configs, but could not know about the two keys only this file has. This file was the last hyphenated one in either org. Canonical spelling confirmed against GitGuardian's own configuration docs and ggshield's `.gitguardian.example.yml`, both of which use underscores throughout. The trap is recorded in the file so the next reader does not "tidy" it back. --- .gitguardian.yaml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.gitguardian.yaml b/.gitguardian.yaml index 0a6ecef..2f1286b 100644 --- a/.gitguardian.yaml +++ b/.gitguardian.yaml @@ -27,13 +27,26 @@ # Writing a placeholder literal here in the clear is safe precisely because it is # a placeholder. Never add an entry for a value that is a real credential; rotate # it and remove it from history instead. +# +# `ignored_paths` below covers `tests/Fixtures/**`, which is generated fixture +# data rather than assertions, so there is no literal to name. That is the one +# place a path glob is the right tool here. +# +# KEY SPELLING IS UNDERSCORED, AND SILENTLY SO +# +# ggshield reads `ignored_paths`, `ignored_matches` and `show_secrets`. A +# hyphenated key is not an alias: it parses as valid YAML, is simply not a key +# ggshield looks for, and the exemption it describes never applies -- with no +# warning, because an unknown key is not an error. This file carried +# `ignored-matches` and `show-secrets` from 2026-09-17 until 2026-11-07, so all +# six exemptions below were inert for that whole period. version: 2 secret: ignored_paths: - "tests/Fixtures/**/*" - ignored-matches: + ignored_matches: # --- Still on `KEY=value` lines in the current tree, so these are the # --- entries actually doing work. @@ -63,4 +76,4 @@ secret: # A fixture that is genuinely a placeholder should be readable as one. If a # finding here is ever anything other than that, fix the code -- do not extend # this list. - show-secrets: false + show_secrets: false