Why is detect-secrets-hook ignoring my audit selections?

Question

detect-secrets-hook in my pre-commit is alerting on secrets that are already marked as safe to be committed in the baseline.

I'm running detect-secrets version 1.4.0 on Python 3.11.0 on Windows 11.

To reproduce:

1. Have a file in a git repo containing something that will get caught as a secret. Update something in the file so that it needs to be committed.
2. Create/recreate a secrets baseline with detect-secrets scan > .secrets.baseline
3. Resave the baseline file as UTF-8, because I'm on Windows.
4. Run detect-secrets audit .secrets.baseline and accept that the secret is okay to be in the file. The segment of the baseline file looks like:

"results": {
    "xyz\\dev_local_settings.py": [
      {
        "type": "Secret Keyword",
        "filename": "xyz\\dev_local_settings.py",
        "hashed_secret": "62f4d1d18d106c8e6f3c79df832893f4b6e95c8e",
        "is_verified": false,
        "line_number": 26,
        "is_secret": false
      }
    ]
  },

5. Have a pre-commit config that looks like this:

repos:
-   repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
    -   id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
        exclude: package.lock.json

6. Attempt to git commit -a.

The pre-commit check will fail on the one known secret:

Detect secrets...........................................................Failed
- hook id: detect-secrets
- exit code: 1

ERROR: Potential secrets about to be committed to git repo!


Secret Type: Secret Keyword
Location:    xyz/dev_local_settings.py:26

7. Another run of detect-secrets audit .secrets.baseline yields "Nothing to audit!"

Am I misunderstanding how detect-secrets works? I would expect it to not alert on a secret that was marked as safe in the baseline.

Answer 1

I resolved the issue by adding a comment containing pragma: allowlist secret in the offending line.

I didn't try it at first, because the issue was in an appsettings.json file of an asp.net project and according to Google json can't have comments. However, seems like Microsoft does allow // comments in appsettings.json.