mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
add docs for infisical scan
This commit is contained in:
Maidul Islam
104
docs/cli/commands/scan-git-changes.mdx
Normal file
104
docs/cli/commands/scan-git-changes.mdx
Normal file
@@ -0,0 +1,104 @@
|
||||
---
|
||||
title: "scan git-changes"
|
||||
description: "Scan for secrets in your uncommitted code"
|
||||
---
|
||||
|
||||
```bash
|
||||
infisical scan git-changes
|
||||
|
||||
# Display the full secret findings
|
||||
infisical scan git-changes --verbose
|
||||
```
|
||||
|
||||
## Description
|
||||
Scanning for secrets before you commit your changes is great way to prevent leaks. Infisical makes this easy with the sub command `git-changes`.
|
||||
|
||||
The `git-changes` scans for uncommitted changes in a Git repository, and is especially designed for use on developer machines, aligning with the ['shift left'](https://cloud.google.com/architecture/devops/devops-tech-shifting-left-on-security) security approach.
|
||||
When `git-changes` is run on a Git repository, Infisical parses the output from a `git diff` command.
|
||||
|
||||
To scan changes in commits that have been staged via `git add`, you can add the `--staged` flag to the sub command. This flag is particularly useful when using Infisical CLI as a pre-commit tool.
|
||||
|
||||
### Flags
|
||||
<Accordion title="--staged">
|
||||
**Description**
|
||||
|
||||
detect secrets in a --staged state
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--log-opts">
|
||||
**Description**
|
||||
|
||||
git log options
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--baseline-path">
|
||||
Short hand: `-b`
|
||||
|
||||
**Description**
|
||||
|
||||
path to baseline with issues that can be ignored
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--config">
|
||||
Short hand: `-c`
|
||||
|
||||
**Description**
|
||||
|
||||
config file path
|
||||
|
||||
order of precedence:
|
||||
1. --config flag
|
||||
2. env var INFISICAL_SCAN_CONFIG
|
||||
3. (--source/-s)/.infisical-scan.toml
|
||||
If none of the three options are used, then Infisical will use the default config
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--exit-code">
|
||||
**Description**
|
||||
|
||||
exit code when leaks have been encountered (default 1)
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--max-target-megabytes">
|
||||
**Description**
|
||||
|
||||
files larger than this will be skipped
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--no-color">
|
||||
**Description**
|
||||
|
||||
turn off color for verbose output
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--redact">
|
||||
**Description**
|
||||
|
||||
redact secrets from logs and stdout
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--report-format">
|
||||
**Description**
|
||||
|
||||
output format (json, csv, sarif) (default "json")
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--report-path">
|
||||
**Description**
|
||||
|
||||
report file
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--source">
|
||||
**Description**
|
||||
|
||||
path to source (default ".")
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--verbose">
|
||||
**Description**
|
||||
|
||||
show verbose output from scan
|
||||
</Accordion>
|
||||
126
docs/cli/commands/scan.mdx
Normal file
126
docs/cli/commands/scan.mdx
Normal file
@@ -0,0 +1,126 @@
|
||||
---
|
||||
title: "scan"
|
||||
description: "Scan git history, directories, and files for secrets"
|
||||
---
|
||||
|
||||
```bash
|
||||
infisical scan
|
||||
|
||||
# Display the full secret findings
|
||||
infisical scan --verbose
|
||||
```
|
||||
|
||||
## Description
|
||||
The `infisical scan` command serves to scan repositories, directories, and files. It's compatible with both individual developer machines and Continuous Integration (CI) environments.
|
||||
|
||||
When you run `infisical scan` on a Git repository, Infisical will parses the output of a `git log -p` command. This command generates [patches](https://stackoverflow.com/questions/8279602/what-is-a-patch-in-git-version-control) that Infisical uses to identify secrets in your code.
|
||||
You can configure the range of commits that `git log` will cover using the `--log-opts` flag.
|
||||
Any options you can use with `git log -p` are valid for `--log-opts`.
|
||||
|
||||
For instance, to instruct Infisical to scan a specific range of commits, use the following command: `infisical scan --log-opts="--all commitA..commitB"`. For more details, refer to the [Git log documentation](https://git-scm.com/docs/git-log).
|
||||
|
||||
To scan individual files and directories, use the `--no-git` flag.
|
||||
|
||||
### Flags
|
||||
<Accordion title="--log-opts">
|
||||
**Description**
|
||||
|
||||
git log options
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--no-git">
|
||||
**Description**
|
||||
|
||||
treat git repo as a regular directory and scan those files, --log-opts has no effect on the scan when --no-git is set
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--pipe">
|
||||
Short hand: `-b`
|
||||
|
||||
**Description**
|
||||
|
||||
scan input from stdin, ex: `cat some_file | infisical scan --pipe`
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--follow-symlinks">
|
||||
Short hand: `-b`
|
||||
|
||||
**Description**
|
||||
scan files that are symlinks to other files
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--baseline-path">
|
||||
Short hand: `-b`
|
||||
|
||||
**Description**
|
||||
|
||||
path to baseline with issues that can be ignored
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--config">
|
||||
Short hand: `-c`
|
||||
|
||||
**Description**
|
||||
|
||||
config file path
|
||||
|
||||
order of precedence:
|
||||
1. --config flag
|
||||
2. env var INFISICAL_SCAN_CONFIG
|
||||
3. (--source/-s)/.infisical-scan.toml
|
||||
If none of the three options are used, then Infisical will use the default config
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--exit-code">
|
||||
**Description**
|
||||
|
||||
exit code when leaks have been encountered (default 1)
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--max-target-megabytes">
|
||||
**Description**
|
||||
|
||||
files larger than this will be skipped
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--no-color">
|
||||
**Description**
|
||||
|
||||
turn off color for verbose output
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--redact">
|
||||
**Description**
|
||||
|
||||
redact secrets from logs and stdout
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--report-format">
|
||||
**Description**
|
||||
|
||||
output format (json, csv, sarif) (default "json")
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--report-path">
|
||||
**Description**
|
||||
|
||||
report file
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--source">
|
||||
**Description**
|
||||
|
||||
path to source (default ".")
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--verbose">
|
||||
**Description**
|
||||
|
||||
show verbose output from scan
|
||||
</Accordion>
|
||||
Reference in New Issue
Block a user