Description
Describe the bug
With MegaLinter v10.0.0, REPOSITORY_BETTERLEAKS runs in project mode and does not appear to forward ADDITIONAL_EXCLUDED_DIRECTORIES to the generated Betterleaks configuration.
To Reproduce
-
Run MegaLinter v10.0.0 with REPOSITORY_BETTERLEAKS.
-
Set:
ADDITIONAL_EXCLUDED_DIRECTORIES=cdk.out
REPOSITORY_BETTERLEAKS_FORWARD_EXCLUDED_DIRECTORIES=true
-
Have a generated infrastructure/cdk.out/ directory in the workspace.
-
Run MegaLinter.
-
Inspect megalinter-reports/betterleaks-config.toml.
Expected behavior
cdk.out should be forwarded to Betterleaks as an excluded directory and should not be scanned.
Screenshots
Not applicable.
Additional context
MegaLinter correctly identifies infrastructure/cdk.out/** as excluded from its own file collection, but this exclusion is not propagated to the generated Betterleaks configuration.
However, the generated Betterleaks configuration contains only:
[allowlist]
paths = [
'\.git/',
'megalinter\-reports/',
'node_modules/',
]cdk.out is missing, and Betterleaks subsequently scans files such as:
infrastructure/cdk.out/cert-spa-dev.template.json
infrastructure/cdk.out/tree.json
and reports findings from the generated CDK output.
MegaLinter logs:
[Excluded directories] Generated /tmp/lint/megalinter-reports/betterleaks-config.toml extending the default ruleset with EXCLUDED_DIRECTORIES as allowlist paths
Environment:
- MegaLinter:
v10.0.0
- Betterleaks:
v1.7.3
REPOSITORY_BETTERLEAKS- CLI lint mode:
project
- Azure DevOps Pipelines
I also tested .betterleaksignore with infrastructure/cdk.out/, but Betterleaks reports it as an invalid .gitleaksignore fingerprint rather than treating it as a directory exclusion.
MegaLinter documentation states that ADDITIONAL_EXCLUDED_DIRECTORIES should provide additional excluded directory basenames and that excluded directories are forwarded to project-mode linters. ([megalinter.io])
This is particularly relevant for generated directories such as AWS CDK's cdk.out, which should not need individual fingerprint suppressions.
Description
Describe the bug
With MegaLinter
v10.0.0,REPOSITORY_BETTERLEAKSruns in project mode and does not appear to forwardADDITIONAL_EXCLUDED_DIRECTORIESto the generated Betterleaks configuration.To Reproduce
Run MegaLinter
v10.0.0withREPOSITORY_BETTERLEAKS.Set:
Have a generated
infrastructure/cdk.out/directory in the workspace.Run MegaLinter.
Inspect
megalinter-reports/betterleaks-config.toml.Expected behavior
cdk.outshould be forwarded to Betterleaks as an excluded directory and should not be scanned.Screenshots
Not applicable.
Additional context
MegaLinter correctly identifies
infrastructure/cdk.out/**as excluded from its own file collection, but this exclusion is not propagated to the generated Betterleaks configuration.However, the generated Betterleaks configuration contains only:
cdk.outis missing, and Betterleaks subsequently scans files such as:and reports findings from the generated CDK output.
MegaLinter logs:
Environment:
v10.0.0v1.7.3REPOSITORY_BETTERLEAKSprojectI also tested
.betterleaksignorewithinfrastructure/cdk.out/, but Betterleaks reports it as an invalid.gitleaksignorefingerprint rather than treating it as a directory exclusion.MegaLinter documentation states that
ADDITIONAL_EXCLUDED_DIRECTORIESshould provide additional excluded directory basenames and that excluded directories are forwarded to project-mode linters. ([megalinter.io])This is particularly relevant for generated directories such as AWS CDK's
cdk.out, which should not need individual fingerprint suppressions.