diff --git a/doc/user/application_security/secret_detection/pre_receive/index.md b/doc/user/application_security/secret_detection/pre_receive/index.md index 90a04a4cc10fe41d9c14435f139e8a68c66a2bef..39514e39220b86fb938bdf810ec371f2509b1e69 100644 --- a/doc/user/application_security/secret_detection/pre_receive/index.md +++ b/doc/user/application_security/secret_detection/pre_receive/index.md @@ -61,9 +61,11 @@ If the blocked secret appears earlier in your Git history: ## Skip secret detection -In some cases, it may be necessary to skip pre-receive secret detection. For example, a developer may need to commit a placeholder secret for testing, or a user may want to bypass secret detection due to a Git operation timeout. There are two ways to skip secret detection: +In some cases, it may be necessary to skip pre-receive secret detection. For example, a developer may need to commit a placeholder secret for testing, or a user may want to bypass secret detection due to a Git operation timeout. -1. To skip secret detection for all commits in a push, add `[skip secret detection]` to one of the commit messages. For example: +There are two ways to skip secret detection for all commits in a push: + +- Add `[skip secret detection]` to one of the commit messages. For example: ```shell # These commits are in the same push. Both will not be scanned. @@ -71,7 +73,7 @@ Add real secret by accident Add placeholder token to test file [skip secret detection] ``` -1. Use a [push option](../../../project/push_options.md#push-options-for-secret-detection) to skip scanning on all commits in a push. For example: +- Use a [push option](../../../project/push_options.md#push-options-for-secret-detection). For example: ```shell # These commits are in the same push. Both will not be scanned. diff --git a/doc/user/project/integrations/git_guardian.md b/doc/user/project/integrations/git_guardian.md index 8e3e240780a76dce1c90f776de258b311ed70a9f..ae098f6c8b68e7aabc7646b4c59c8ba748c0d813 100644 --- a/doc/user/project/integrations/git_guardian.md +++ b/doc/user/project/integrations/git_guardian.md @@ -72,6 +72,17 @@ To enable the integration for your project: GitLab is now ready to reject commits based on GitGuardian policies. +## Skip secret detection + +> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/152064) in GitLab 17.0. + +You can skip GitGuardian secret detection, if needed. The options to skip +secret detection for all commits in a push are identical to the options for +[Native Secret Detection](../../application_security/secret_detection/pre_receive/index.md#skip-secret-detection). Either: + +- Add `[skip secret detection]` to one of the commit messages. +- Use the `secret_detection.skip_all` push option. + ## Known issues - Pushes can be delayed or can time out. With the GitGuardian integration, pushes are sent to a third-party, and GitLab has no control over the connection with GitGuardian or the GitGuardian process. diff --git a/ee/lib/gitlab/checks/integrations/git_guardian_check.rb b/ee/lib/gitlab/checks/integrations/git_guardian_check.rb index 3395f3419d919d3ca7e5fc911da627af81d2689d..b4160b16a523e722b729f1df8d4f6e1f048c6615 100644 --- a/ee/lib/gitlab/checks/integrations/git_guardian_check.rb +++ b/ee/lib/gitlab/checks/integrations/git_guardian_check.rb @@ -19,7 +19,7 @@ class GitGuardianCheck < ::Gitlab::Checks::BaseBulkChecker [To apply with caution] If you want to bypass the secrets check: - 1. Add [skip secret detection] flag to the commit message. + 1. Add [skip secret detection] flag to the commit message or add the following Git push option: `-o secret_detection.skip_all`. 2. Commit and try pushing again. MESSAGE @@ -56,7 +56,13 @@ def changed_blobs(timeout:) end def skip_secret_detection? - changes_access.commits.any? { |commit| commit.safe_message =~ SPECIAL_COMMIT_FLAG } + return true if changes_access.commits.any? do |commit| + commit.safe_message =~ ::Gitlab::Checks::SecretsCheck::SPECIAL_COMMIT_FLAG + end + + return true if changes_access.push_options&.get(:secret_detection, :skip_all) + + false end def revisions diff --git a/ee/lib/gitlab/checks/secrets_check.rb b/ee/lib/gitlab/checks/secrets_check.rb index 2a63cbd7a425d52c41f54c0f60d0a12581820759..a33c1adf0497915e6c6642e74bd8fc31eeab2336 100644 --- a/ee/lib/gitlab/checks/secrets_check.rb +++ b/ee/lib/gitlab/checks/secrets_check.rb @@ -16,8 +16,8 @@ class SecretsCheck < ::Gitlab::Checks::BaseBulkChecker LOG_MESSAGES = { secrets_check: 'Detecting secrets...', secrets_not_found: 'Secret detection scan completed with no findings.', - skip_secret_detection: "\n\nTo skip pre-receive secret detection, add the following git push option: " \ - "`--push-option secret_detection.skip_all` to your push command.", + skip_secret_detection: "\n\nTo skip pre-receive secret detection, add the following Git push option" \ + "to your push command: `-o secret_detection.skip_all`", found_secrets: "\n\n--------------------------------------------------" \ "\nPUSH BLOCKED: Secrets detected in code changes" \ "\n--------------------------------------------------", diff --git a/ee/spec/lib/gitlab/checks/integrations/git_guardian_check_spec.rb b/ee/spec/lib/gitlab/checks/integrations/git_guardian_check_spec.rb index 1c493647989d9fd2e249a18e2e4ff8d06afccfce..45d756be998f7f7f81695cf523e44dcbde83b9e2 100644 --- a/ee/spec/lib/gitlab/checks/integrations/git_guardian_check_spec.rb +++ b/ee/spec/lib/gitlab/checks/integrations/git_guardian_check_spec.rb @@ -102,6 +102,8 @@ context 'when a commit contains a special flag' do it 'does not raise an error' do + expect(::Gitlab::GitGuardian::Client).not_to receive(:new) + allow(changes_access.commits.first).to receive(:safe_message).and_return( "#{changes_access.commits.first.safe_message}\n[skip secret detection]" ) @@ -109,6 +111,16 @@ expect { git_guardian_check.validate! }.not_to raise_error end end + + context 'when secret_detection.skip_all push option is passed' do + let(:push_options) { Gitlab::PushOptions.new(["secret_detection.skip_all"]) } + + it 'does not raise an error' do + expect(::Gitlab::GitGuardian::Client).not_to receive(:new) + + expect { git_guardian_check.validate! }.not_to raise_error + end + end end end end