Betterleaks does not honor ADDITIONAL_EXCLUDED_DIRECTORIES

[ashokm]

Description

Describe the bug

With MegaLinter v10.0.0, REPOSITORY_BETTERLEAKS runs in project mode and does not appear to forward ADDITIONAL_EXCLUDED_DIRECTORIES to the generated Betterleaks configuration.

To Reproduce

1. Run MegaLinter v10.0.0 with REPOSITORY_BETTERLEAKS.

2. Set:

   ADDITIONAL_EXCLUDED_DIRECTORIES=cdk.out
   REPOSITORY_BETTERLEAKS_FORWARD_EXCLUDED_DIRECTORIES=true
   

3. Have a generated infrastructure/cdk.out/ directory in the workspace.

4. Run MegaLinter.

5. Inspect megalinter-reports/betterleaks-config.toml.

Expected behavior

cdk.out should be forwarded to Betterleaks as an excluded directory and should not be scanned.

Screenshots

Not applicable.

Additional context

MegaLinter correctly identifies infrastructure/cdk.out/** as excluded from its own file collection, but this exclusion is not propagated to the generated Betterleaks configuration.

However, the generated Betterleaks configuration contains only:

[allowlist]
paths = [
    '\.git/',
    'megalinter\-reports/',
    'node_modules/',
]

cdk.out is missing, and Betterleaks subsequently scans files such as:

infrastructure/cdk.out/cert-spa-dev.template.json
infrastructure/cdk.out/tree.json

and reports findings from the generated CDK output.

MegaLinter logs:

[Excluded directories] Generated /tmp/lint/megalinter-reports/betterleaks-config.toml extending the default ruleset with EXCLUDED_DIRECTORIES as allowlist paths

Environment:

• MegaLinter: v10.0.0
• Betterleaks: v1.7.3
• REPOSITORY_BETTERLEAKS
• CLI lint mode: project
• Azure DevOps Pipelines

I also tested .betterleaksignore with infrastructure/cdk.out/, but Betterleaks reports it as an invalid .gitleaksignore fingerprint rather than treating it as a directory exclusion.

MegaLinter documentation states that ADDITIONAL_EXCLUDED_DIRECTORIES should provide additional excluded directory basenames and that excluded directories are forwarded to project-mode linters. ([megalinter.io])

This is particularly relevant for generated directories such as AWS CDK's cdk.out, which should not need individual fingerprint suppressions.