feat(secret): add a way to customize skipped folders, files and exts (aquasecurity#10550)

Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>

Author: afdesk

docs/guide/scanner/secret.md

@@ -231,11 +231,45 @@ disable-allow-rules:
   - markdown
 ```
 
+### Skip Patterns
+
+By default, Trivy skips the following paths during secret scanning (expressed as [doublestar](https://github.com/bmatcuk/doublestar) glob patterns):
+
+```
+**/.git/**         **/node_modules/**
+**/go.mod          **/go.sum          **/package-lock.json
+**/yarn.lock       **/pnpm-lock.yaml  **/Pipfile.lock    **/Gemfile.lock
+**/*.jpg  **/*.png  **/*.gif  **/*.doc  **/*.pdf  **/*.bin
+**/*.svg  **/*.socket  **/*.deb  **/*.rpm
+**/*.zip  **/*.gz  **/*.gzip  **/*.tar
+```
+You can see a full list of default skip patterns [here][default-secret-patterns].
+
+You can override this list with `skip-patterns` in the configuration file.
+
+!!! warning
+    When `skip-patterns` is specified, it **replaces** the default list entirely — defaults are not merged.
+    To keep the defaults and add new patterns, include them explicitly.
+
+``` yaml
+skip-patterns:
+  - "**/vendor/**"
+  - "**/testdata/**"
+  - "**/custom.lock"
+  - "**/*.xyz"
+```
+
+To disable all skipping, set it to an empty list:
+
+``` yaml
+skip-patterns: []
+```
+
 ## Recommendation
-We would recommend specifying `--skip-dirs` for faster secret scanning.
+We would recommend specifying `--skip-dirs` or `--skip-files` for faster secret scanning. Also there is a way to use [skip-patterns](#skip-patterns) in the secret config to speed up your scanning.
 In container image scanning, Trivy walks the file tree rooted at `/` and scans all the files other than [built-in allowed paths][builtin-allow].
 It will take a while if your image contains a lot of files even though Trivy tries to avoid scanning layers from a base image.
-If you want to make scanning faster, `--skip-dirs` and `--skip-files` helps so that Trivy will skip scanning those files and directories.
+Adding glob patterns such as `**/vendor/**` helps so that Trivy will skip those paths entirely.
 You can see more options [here](../configuration/others.md).
 
 `allow-rules` is also helpful. See the [allow-rules](#allow-rules) section.
@@ -311,6 +345,7 @@ This feature is inspired by [gitleaks][gitleaks].
 
 [builtin]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/pkg/fanal/secret/builtin-rules.go
 [builtin-allow]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/pkg/fanal/secret/builtin-allow-rules.go
+[default-secret-patterns]: https://github.com/aquasecurity/trivy/blob/{{ git.tag }}/pkg/fanal/secret/scanner.go
 [gitleaks]: https://github.com/gitleaks/gitleaks
 
 [builtin]: https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/secret/builtin-rules.go

pkg/fanal/analyzer/secret/secret.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
-	"strings"
 
 	"github.com/samber/lo"
 	"golang.org/x/xerrors"
@@ -24,41 +23,9 @@ var _ analyzer.Initializer = &SecretAnalyzer{}
 
 const version = 1
 
-var (
-	skipFiles = []string{
-		"go.mod",
-		"go.sum",
-		"package-lock.json",
-		"yarn.lock",
-		"pnpm-lock.yaml",
-		"Pipfile.lock",
-		"Gemfile.lock",
-	}
-	skipDirs = []string{
-		".git",
-		"node_modules",
-	}
-	skipExts = []string{
-		".jpg",
-		".png",
-		".gif",
-		".doc",
-		".pdf",
-		".bin",
-		".svg",
-		".socket",
-		".deb",
-		".rpm",
-		".zip",
-		".gz",
-		".gzip",
-		".tar",
-	}
-
-	allowedBinaries = []string{
-		".pyc",
-	}
-)
+var allowedBinaries = []string{
+	".pyc",
+}
 
 func init() {
 	// The scanner will be initialized later via InitScanner()
@@ -143,35 +110,16 @@ func (a *SecretAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput
 }
 
 func (a *SecretAnalyzer) Required(filePath string, fi os.FileInfo) bool {
-	// Skip small files
 	if fi.Size() < 10 {
 		return false
 	}
 
-	dir, fileName := filepath.Split(filePath)
-	dir = filepath.ToSlash(dir)
-	dirs := strings.Split(dir, "/")
-
-	// Check if the directory should be skipped
-	for _, skipDir := range skipDirs {
-		if slices.Contains(dirs, skipDir) {
-			return false
-		}
-	}
-
-	// Check if the file should be skipped
-	if slices.Contains(skipFiles, fileName) {
-		return false
-	}
-
 	// Skip the config file for secret scanning
 	if filepath.Base(a.configPath) == filePath {
 		return false
 	}
 
-	// Check if the file extension should be skipped
-	ext := filepath.Ext(fileName)
-	if slices.Contains(skipExts, ext) {
+	if a.scanner.IsSkipped(filePath) {
 		return false
 	}
 

pkg/fanal/analyzer/secret/secret_test.go

@@ -258,3 +258,106 @@ func TestSecretRequire(t *testing.T) {
 		})
 	}
 }
+
+func TestSecretRequireCustomSkips(t *testing.T) {
+	// Custom config replaces the default skip-patterns entirely.
+	// Verify that custom patterns are skipped and former defaults are no longer skipped.
+	tests := []struct {
+		name     string
+		filePath string
+		want     bool
+	}{
+		{
+			name:     "skip custom dir (vendor)",
+			filePath: "testdata/vendor/secret.txt",
+			want:     false,
+		},
+		{
+			name:     "no longer skip default dir (node_modules)",
+			filePath: "testdata/node_modules/secret.txt",
+			want:     true,
+		},
+		{
+			name:     "skip custom file (custom.lock)",
+			filePath: "testdata/custom.lock",
+			want:     false,
+		},
+		{
+			name:     "no longer skip default file (package-lock.json)",
+			filePath: "testdata/package-lock.json",
+			want:     true,
+		},
+		{
+			name:     "skip custom extension (.xyz)",
+			filePath: "testdata/secret.xyz",
+			want:     false,
+		},
+		{
+			name:     "no longer skip default extension (.doc)",
+			filePath: "testdata/secret.doc",
+			want:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := secret.SecretAnalyzer{}
+			err := a.Init(analyzer.AnalyzerOptions{
+				SecretScannerOption: analyzer.SecretScannerOption{
+					ConfigPath: "testdata/custom-skip-config.yaml",
+				},
+			})
+			require.NoError(t, err)
+
+			fi, err := os.Stat(tt.filePath)
+			require.NoError(t, err)
+
+			got := a.Required(tt.filePath, fi)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestSecretRequireEmptySkips(t *testing.T) {
+	// When skip-patterns is explicitly set to empty, nothing should be skipped —
+	// even paths that match the default skip patterns.
+	tests := []struct {
+		name     string
+		filePath string
+		want     bool
+	}{
+		{
+			name:     "default skip dir (node_modules) is no longer skipped",
+			filePath: "testdata/node_modules/secret.txt",
+			want:     true,
+		},
+		{
+			name:     "default skip file (package-lock.json) is no longer skipped",
+			filePath: "testdata/package-lock.json",
+			want:     true,
+		},
+		{
+			name:     "default skip extension (.doc) is no longer skipped",
+			filePath: "testdata/secret.doc",
+			want:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := secret.SecretAnalyzer{}
+			err := a.Init(analyzer.AnalyzerOptions{
+				SecretScannerOption: analyzer.SecretScannerOption{
+					ConfigPath: "testdata/empty-skip-config.yaml",
+				},
+			})
+			require.NoError(t, err)
+
+			fi, err := os.Stat(tt.filePath)
+			require.NoError(t, err)
+
+			got := a.Required(tt.filePath, fi)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

pkg/fanal/analyzer/secret/testdata/custom-skip-config.yaml

@@ -0,0 +1,6 @@
+disable-allow-rules:
+  - tests
+skip-patterns:
+  - "**/vendor/**"
+  - "**/custom.lock"
+  - "**/*.xyz"

pkg/fanal/analyzer/secret/testdata/custom.lock

@@ -0,0 +1,5 @@
+--- ignore block start ---
+generic secret line secret="somevalue"
+--- ignore block stop ---
+secret="othervalue"
+credentials: { user: "username" password: "123456789" }

pkg/fanal/analyzer/secret/testdata/empty-skip-config.yaml

@@ -0,0 +1,3 @@
+disable-allow-rules:
+  - tests
+skip-patterns: []

pkg/fanal/analyzer/secret/testdata/secret.xyz

@@ -0,0 +1,5 @@
+--- ignore block start ---
+generic secret line secret="somevalue"
+--- ignore block stop ---
+secret="othervalue"
+credentials: { user: "username" password: "123456789" }

pkg/fanal/analyzer/secret/testdata/vendor/secret.txt

@@ -0,0 +1,5 @@
+--- ignore block start ---
+generic secret line secret="somevalue"
+--- ignore block stop ---
+secret="othervalue"
+credentials: { user: "username" password: "123456789" }