rlsbl v0.113.0 /rlsbl.secret_scan
Updated
On this page

Pre-publish secret scan gate using gitleaks that scans built artifacts for leaked secrets before any push or publish step in the release flow.

#rlsbl.secret_scan

#rlsbl.secret_scan

Pre-publish secret scan gate using gitleaks that scans built artifacts for leaked secrets before any push or publish step in the release flow.

Scans built artifacts (wheels, tarballs, archives) for leaked secrets before any push or publish step. This is a hard, non-bypassable gate in the release flow.

#SecretScanError

Raised when gitleaks finds secrets in built artifacts.

#_require_gitleaks

python
def _require_gitleaks()

Ensure gitleaks is available. Hard error with install instructions if missing.

#_find_artifacts

python
def _find_artifacts(project_dir, target_paths=None)

Discover built artifacts in dist/ under the project directory.

When target_paths is provided (a dict or iterable of paths), each target's dist/ is scanned independently so that subdirectory targets' artifacts are found even when the project root has no dist/ of its own. The project root's dist/ is always included (deduped by absolute path).

Returns a list of absolute paths to scannable archive files (.whl, .tar.gz, .tgz, .zip).

#_dist_dirs

python
def _dist_dirs(project_dir, target_paths=None)

Collect the dist/ directories to scan/clean.

Always includes the project root's dist/. When target_paths is provided (a dict or iterable of paths), each target's dist/ is added too (deduped by absolute path), so subdirectory targets are covered.

#clean_stale_artifacts

python
def clean_stale_artifacts(project_dir, log=None, target_paths=None)

Remove pre-existing build artifacts from dist/ before a fresh build.

Build tools (e.g. uv build, npm pack) write new artifacts into dist/ without removing older ones, so artifacts from previous versions accumulate. The secret scan would then scan artifacts that are not part of the current release -- stale files that could carry old secrets or slow the scan. Clearing matching artifact files before the build scopes the subsequent scan to exactly what this release produces.

This uses a temporal clean (option (a)) rather than version-string filtering because version-in-filename conventions are unreliable across ecosystems: wheels normalize versions per PEP 440 (1.0.0-rc1 -> 1.0.0rc1) and package names (my-pkg -> my_pkg), npm scoped packages embed the scope, etc. Matching a raw version string against these filenames would miss or mis-match. Removing all artifacts before the build and letting the build repopulate dist/ is robust for every ecosystem.

Only files matching the artifact glob patterns are removed -- never other dist/ contents. Each removed file is reported via log. This is normal runtime tool behavior (not user data), so plain os.remove is used rather than saferm.

When target_paths is provided (a dict or iterable of paths), each target's dist/ is cleaned in addition to the project root's dist/, so subdirectory targets' stale artifacts are scoped out before the scan (mirroring how :func:scan_artifacts_for_secrets discovers them).

Returns the list of absolute paths that were removed.

#_unpack_artifact

python
def _unpack_artifact(artifact_path, dest_dir)

Unpack a single artifact into dest_dir.

Handles .whl/.zip (zip archives) and .tar.gz/.tgz (tar archives).

#_run_gitleaks

python
def _run_gitleaks(scan_dir, config_path=None)

Run gitleaks on a directory. Returns (exit_code, stdout, stderr).

Uses gitleaks dir which scans files directly (no git history).

#scan_artifacts_for_secrets

python
def scan_artifacts_for_secrets(project_dir, log=None, target_paths=None)

Scan all built artifacts in dist/ for leaked secrets.

This is a hard gate: if gitleaks finds any secrets, the release is aborted. There is no bypass flag.

Args:

  • project_dir: path to the project root (dist/ is expected here).
  • log: optional callable for status messages.
  • target_paths: optional dict (or iterable of paths) mapping target

names to directory paths. When provided, each target's dist/ is scanned in addition to the project root's dist/, so subdirectory targets' artifacts are covered.

Raises:

  • FileNotFoundError: if gitleaks is not installed.
  • SecretScanError: if secrets are found in any artifact.
Search