Skip to content

Commit aba09c1

Browse files
monty-botmonty-bot
committed
🚀 releasing version 3.4.0 @ 2026-04-07 16:06
[skip ci]
1 parent 593860a commit aba09c1

18 files changed

Lines changed: 755 additions & 30 deletions

‎CHANGELOG.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,22 @@ This project was forked from version 1.7.4 of [mbed-tools-ci-scripts](https://gi
1717

1818
[//]: # (begin_release_notes)
1919

20+
"3.4.0" (2026-04-07)
21+
====================
22+
23+
Features
24+
--------
25+
26+
- :sparkles: add `cd-detect-secrets` to check tracked files against the recorded [detect-secrets](https://github.com/Yelp/detect-secrets) registry so new secrets are not introduced into the repository (#20260407160538)
27+
- :sparkles: add `cd-record-secrets` to record acceptable findings in the repository secret registry using [detect-secrets](https://github.com/Yelp/detect-secrets) so known safe values are not flagged repeatedly (#20260407160539)
28+
29+
30+
Bugfixes
31+
--------
32+
33+
- Dependency upgrade: checkout-6.0.2 (#20260403063309)
34+
35+
2036
"3.3.0" (2026-04-02)
2137
====================
2238

‎continuous_delivery_scripts/_version.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
This file is autogenerated, do not modify by hand.
1212
"""
1313

14-
__version__ = "3.3.0"
15-
COMMIT = "0bb13bc2abd9af0d72e709afd285d977cc06d8ba"
14+
__version__ = "3.4.0"
15+
COMMIT = "593860a336acbead96e80e1a5c55aee240dbf97e"
1616
MAJOR = 3
17-
MINOR = 3
17+
MINOR = 4
1818
PATCH = 0

‎docs/detect_secrets.html‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
<!--
2+
-- Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
3+
-- SPDX-License-Identifier: Apache-2.0
4+
-->
5+
<!doctype html>
6+
<html lang="en">
7+
<head>
8+
<meta charset="utf-8">
9+
<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1" />
10+
<meta name="generator" content="pdoc 0.10.0" />
11+
<title>continuous_delivery_scripts.detect_secrets API documentation</title>
12+
<meta name="description" content="Check tracked files against the project&#39;s recorded secret registry." />
13+
<link rel="preload stylesheet" as="style" href="https://cdnjs.cloudflare.com/ajax/libs/10up-sanitize.css/11.0.1/sanitize.min.css" integrity="sha256-PK9q560IAAa6WVRRh76LtCaI8pjTJ2z11v0miyNNjrs=" crossorigin>
14+
<link rel="preload stylesheet" as="style" href="https://cdnjs.cloudflare.com/ajax/libs/10up-sanitize.css/11.0.1/typography.min.css" integrity="sha256-7l/o7C8jubJiy74VsKTidCy1yBkRtiUGbVkYBylBqUg=" crossorigin>
15+
<link rel="stylesheet preload" as="style" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.1/styles/github.min.css" crossorigin>
16+
<style>:root{--highlight-color:#fe9}.flex{display:flex !important}body{line-height:1.5em}#content{padding:20px}#sidebar{padding:30px;overflow:hidden}#sidebar > *:last-child{margin-bottom:2cm}.http-server-breadcrumbs{font-size:130%;margin:0 0 15px 0}#footer{font-size:.75em;padding:5px 30px;border-top:1px solid #ddd;text-align:right}#footer p{margin:0 0 0 1em;display:inline-block}#footer p:last-child{margin-right:30px}h1,h2,h3,h4,h5{font-weight:300}h1{font-size:2.5em;line-height:1.1em}h2{font-size:1.75em;margin:1em 0 .50em 0}h3{font-size:1.4em;margin:25px 0 10px 0}h4{margin:0;font-size:105%}h1:target,h2:target,h3:target,h4:target,h5:target,h6:target{background:var(--highlight-color);padding:.2em 0}a{color:#058;text-decoration:none;transition:color .3s ease-in-out}a:hover{color:#e82}.title code{font-weight:bold}h2[id^="header-"]{margin-top:2em}.ident{color:#900}pre code{background:#f8f8f8;font-size:.8em;line-height:1.4em}code{background:#f2f2f1;padding:1px 4px;overflow-wrap:break-word}h1 code{background:transparent}pre{background:#f8f8f8;border:0;border-top:1px solid #ccc;border-bottom:1px solid #ccc;margin:1em 0;padding:1ex}#http-server-module-list{display:flex;flex-flow:column}#http-server-module-list div{display:flex}#http-server-module-list dt{min-width:10%}#http-server-module-list p{margin-top:0}.toc ul,#index{list-style-type:none;margin:0;padding:0}#index code{background:transparent}#index h3{border-bottom:1px solid #ddd}#index ul{padding:0}#index h4{margin-top:.6em;font-weight:bold}@media (min-width:200ex){#index .two-column{column-count:2}}@media (min-width:300ex){#index .two-column{column-count:3}}dl{margin-bottom:2em}dl dl:last-child{margin-bottom:4em}dd{margin:0 0 1em 3em}#header-classes + dl > dd{margin-bottom:3em}dd dd{margin-left:2em}dd p{margin:10px 0}.name{background:#eee;font-weight:bold;font-size:.85em;padding:5px 10px;display:inline-block;min-width:40%}.name:hover{background:#e0e0e0}dt:target .name{background:var(--highlight-color)}.name > span:first-child{white-space:nowrap}.name.class > span:nth-child(2){margin-left:.4em}.inherited{color:#999;border-left:5px solid #eee;padding-left:1em}.inheritance em{font-style:normal;font-weight:bold}.desc h2{font-weight:400;font-size:1.25em}.desc h3{font-size:1em}.desc dt code{background:inherit}.source summary,.git-link-div{color:#666;text-align:right;font-weight:400;font-size:.8em;text-transform:uppercase}.source summary > *{white-space:nowrap;cursor:pointer}.git-link{color:inherit;margin-left:1em}.source pre{max-height:500px;overflow:auto;margin:0}.source pre code{font-size:12px;overflow:visible}.hlist{list-style:none}.hlist li{display:inline}.hlist li:after{content:',\2002'}.hlist li:last-child:after{content:none}.hlist .hlist{display:inline;padding-left:1em}img{max-width:100%}td{padding:0 .5em}.admonition{padding:.1em .5em;margin-bottom:1em}.admonition-title{font-weight:bold}.admonition.note,.admonition.info,.admonition.important{background:#aef}.admonition.todo,.admonition.versionadded,.admonition.tip,.admonition.hint{background:#dfd}.admonition.warning,.admonition.versionchanged,.admonition.deprecated{background:#fd4}.admonition.error,.admonition.danger,.admonition.caution{background:lightpink}</style>
17+
<style media="screen and (min-width: 700px)">@media screen and (min-width:700px){#sidebar{width:30%;height:100vh;overflow:auto;position:sticky;top:0}#content{width:70%;max-width:100ch;padding:3em 4em;border-left:1px solid #ddd}pre code{font-size:1em}.item .name{font-size:1em}main{display:flex;flex-direction:row-reverse;justify-content:flex-end}.toc ul ul,#index ul{padding-left:1.5em}.toc > ul > li{margin-top:.5em}}</style>
18+
<style media="print">@media print{#sidebar h1{page-break-before:always}.source{display:none}}@media print{*{background:transparent !important;color:#000 !important;box-shadow:none !important;text-shadow:none !important}a[href]:after{content:" (" attr(href) ")";font-size:90%}a[href][title]:after{content:none}abbr[title]:after{content:" (" attr(title) ")"}.ir a:after,a[href^="javascript:"]:after,a[href^="#"]:after{content:""}pre,blockquote{border:1px solid #999;page-break-inside:avoid}thead{display:table-header-group}tr,img{page-break-inside:avoid}img{max-width:100% !important}@page{margin:0.5cm}p,h2,h3{orphans:3;widows:3}h1,h2,h3,h4,h5,h6{page-break-after:avoid}}</style>
19+
<script defer src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.1/highlight.min.js" integrity="sha256-Uv3H6lx7dJmRfRvH8TH6kJD1TSK1aFcwgx+mdg3epi8=" crossorigin></script>
20+
<script>window.addEventListener('DOMContentLoaded', () => hljs.initHighlighting())</script>
21+
</head>
22+
<body>
23+
<main>
24+
<article id="content">
25+
<header>
26+
<h1 class="title">Module <code>continuous_delivery_scripts.detect_secrets</code></h1>
27+
</header>
28+
<section id="section-intro">
29+
<p>Check tracked files against the project's recorded secret registry.</p>
30+
<details class="source">
31+
<summary>
32+
<span>Expand source code</span>
33+
</summary>
34+
<pre><code class="python">#
35+
# Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
36+
# SPDX-License-Identifier: Apache-2.0
37+
#
38+
&#34;&#34;&#34;Check tracked files against the project&#39;s recorded secret registry.&#34;&#34;&#34;
39+
40+
import argparse
41+
import logging
42+
import subprocess
43+
import sys
44+
from pathlib import Path
45+
from typing import List, Optional
46+
47+
from continuous_delivery_scripts.update_secrets_registry import (
48+
_determine_exclude_files,
49+
_get_secrets_baseline_file,
50+
_get_secrets_baseline_filename,
51+
)
52+
from continuous_delivery_scripts.utils.git_helpers import ProjectGitWrapper
53+
from continuous_delivery_scripts.utils.logging import log_exception, set_log_level
54+
55+
logger = logging.getLogger(__name__)
56+
57+
58+
def _generate_detect_secrets_hook_command_list(
59+
baseline_file: Path, exclude_files: List[str], tracked_files: List[str]
60+
) -&gt; List[str]:
61+
command = [&#34;detect-secrets-hook&#34;, &#34;--baseline&#34;, str(baseline_file)]
62+
for exclude_file in exclude_files:
63+
command.extend([&#34;--exclude-files&#34;, exclude_file])
64+
command.extend(tracked_files)
65+
return command
66+
67+
68+
def _filter_tracked_files(tracked_files: List[str], project_root: Path, registry_file: Path) -&gt; List[str]:
69+
&#34;&#34;&#34;Remove the registry file from tracked files to avoid scanning recorded accepted findings.&#34;&#34;&#34;
70+
try:
71+
registry_relative_path = registry_file.relative_to(project_root).as_posix()
72+
except ValueError:
73+
return tracked_files
74+
return [path for path in tracked_files if path != registry_relative_path]
75+
76+
77+
def detect_secrets(baseline_file: Optional[Path] = None) -&gt; None:
78+
&#34;&#34;&#34;Check tracked files so new secrets are not introduced.&#34;&#34;&#34;
79+
git = ProjectGitWrapper()
80+
project_root = Path(str(git.root))
81+
resolved_baseline = _get_secrets_baseline_file(baseline_file)
82+
tracked_files = _filter_tracked_files(git.list_tracked_files(), project_root, resolved_baseline)
83+
if not tracked_files:
84+
logger.info(&#34;No tracked files found for detect-secrets.&#34;)
85+
return
86+
subprocess.check_call(
87+
_generate_detect_secrets_hook_command_list(resolved_baseline, _determine_exclude_files(), tracked_files),
88+
cwd=str(project_root),
89+
)
90+
91+
92+
def main() -&gt; int:
93+
&#34;&#34;&#34;Script CLI.&#34;&#34;&#34;
94+
parser = argparse.ArgumentParser(
95+
description=(
96+
&#34;Check tracked files against the recorded secret registry so new secrets are not committed. &#34;
97+
&#34;This uses Yelp detect-secrets (https://github.com/Yelp/detect-secrets).&#34;
98+
)
99+
)
100+
parser.add_argument(
101+
&#34;-r&#34;,
102+
&#34;--registry-file&#34;,
103+
default=Path(_get_secrets_baseline_filename()),
104+
help=&#34;Secret registry file to use.&#34;,
105+
type=Path,
106+
)
107+
parser.add_argument(
108+
&#34;-v&#34;,
109+
&#34;--verbose&#34;,
110+
action=&#34;count&#34;,
111+
default=0,
112+
help=&#34;Verbosity, by default errors are reported.&#34;,
113+
)
114+
args = parser.parse_args()
115+
set_log_level(args.verbose)
116+
117+
try:
118+
detect_secrets(args.registry_file)
119+
return 0
120+
except Exception as e:
121+
log_exception(logger, e)
122+
return 1
123+
124+
125+
if __name__ == &#34;__main__&#34;:
126+
sys.exit(main())</code></pre>
127+
</details>
128+
</section>
129+
<section>
130+
</section>
131+
<section>
132+
</section>
133+
<section>
134+
<h2 class="section-title" id="header-functions">Functions</h2>
135+
<dl>
136+
<dt id="continuous_delivery_scripts.detect_secrets.detect_secrets"><code class="name flex">
137+
<span>def <span class="ident">detect_secrets</span></span>(<span>baseline_file: Optional[pathlib.Path] = None) ‑> None</span>
138+
</code></dt>
139+
<dd>
140+
<div class="desc"><p>Check tracked files so new secrets are not introduced.</p></div>
141+
<details class="source">
142+
<summary>
143+
<span>Expand source code</span>
144+
</summary>
145+
<pre><code class="python">def detect_secrets(baseline_file: Optional[Path] = None) -&gt; None:
146+
&#34;&#34;&#34;Check tracked files so new secrets are not introduced.&#34;&#34;&#34;
147+
git = ProjectGitWrapper()
148+
project_root = Path(str(git.root))
149+
resolved_baseline = _get_secrets_baseline_file(baseline_file)
150+
tracked_files = _filter_tracked_files(git.list_tracked_files(), project_root, resolved_baseline)
151+
if not tracked_files:
152+
logger.info(&#34;No tracked files found for detect-secrets.&#34;)
153+
return
154+
subprocess.check_call(
155+
_generate_detect_secrets_hook_command_list(resolved_baseline, _determine_exclude_files(), tracked_files),
156+
cwd=str(project_root),
157+
)</code></pre>
158+
</details>
159+
</dd>
160+
<dt id="continuous_delivery_scripts.detect_secrets.main"><code class="name flex">
161+
<span>def <span class="ident">main</span></span>(<span>) ‑> int</span>
162+
</code></dt>
163+
<dd>
164+
<div class="desc"><p>Script CLI.</p></div>
165+
<details class="source">
166+
<summary>
167+
<span>Expand source code</span>
168+
</summary>
169+
<pre><code class="python">def main() -&gt; int:
170+
&#34;&#34;&#34;Script CLI.&#34;&#34;&#34;
171+
parser = argparse.ArgumentParser(
172+
description=(
173+
&#34;Check tracked files against the recorded secret registry so new secrets are not committed. &#34;
174+
&#34;This uses Yelp detect-secrets (https://github.com/Yelp/detect-secrets).&#34;
175+
)
176+
)
177+
parser.add_argument(
178+
&#34;-r&#34;,
179+
&#34;--registry-file&#34;,
180+
default=Path(_get_secrets_baseline_filename()),
181+
help=&#34;Secret registry file to use.&#34;,
182+
type=Path,
183+
)
184+
parser.add_argument(
185+
&#34;-v&#34;,
186+
&#34;--verbose&#34;,
187+
action=&#34;count&#34;,
188+
default=0,
189+
help=&#34;Verbosity, by default errors are reported.&#34;,
190+
)
191+
args = parser.parse_args()
192+
set_log_level(args.verbose)
193+
194+
try:
195+
detect_secrets(args.registry_file)
196+
return 0
197+
except Exception as e:
198+
log_exception(logger, e)
199+
return 1</code></pre>
200+
</details>
201+
</dd>
202+
</dl>
203+
</section>
204+
<section>
205+
</section>
206+
</article>
207+
<nav id="sidebar">
208+
<h1>Index</h1>
209+
<div class="toc">
210+
<ul></ul>
211+
</div>
212+
<ul id="index">
213+
<li><h3>Super-module</h3>
214+
<ul>
215+
<li><code><a title="continuous_delivery_scripts" href="index.html">continuous_delivery_scripts</a></code></li>
216+
</ul>
217+
</li>
218+
<li><h3><a href="#header-functions">Functions</a></h3>
219+
<ul class="">
220+
<li><code><a title="continuous_delivery_scripts.detect_secrets.detect_secrets" href="#continuous_delivery_scripts.detect_secrets.detect_secrets">detect_secrets</a></code></li>
221+
<li><code><a title="continuous_delivery_scripts.detect_secrets.main" href="#continuous_delivery_scripts.detect_secrets.main">main</a></code></li>
222+
</ul>
223+
</li>
224+
</ul>
225+
</nav>
226+
</main>
227+
<footer id="footer">
228+
<p>Generated by <a href="https://pdoc3.github.io/pdoc" title="pdoc: Python API documentation generator"><cite>pdoc</cite> 0.10.0</a>.</p>
229+
</footer>
230+
</body>
231+
</html>

‎docs/index.html‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,10 @@ <h2 class="section-title" id="header-submodules">Sub-modules</h2>
5151
<dd>
5252
<div class="desc"><p>Easy news files generation …</p></div>
5353
</dd>
54+
<dt><code class="name"><a title="continuous_delivery_scripts.detect_secrets" href="detect_secrets.html">continuous_delivery_scripts.detect_secrets</a></code></dt>
55+
<dd>
56+
<div class="desc"><p>Check tracked files against the project's recorded secret registry.</p></div>
57+
</dd>
5458
<dt><code class="name"><a title="continuous_delivery_scripts.generate_docs" href="generate_docs.html">continuous_delivery_scripts.generate_docs</a></code></dt>
5559
<dd>
5660
<div class="desc"><p>Generates documentation.</p></div>
@@ -91,6 +95,10 @@ <h2 class="section-title" id="header-submodules">Sub-modules</h2>
9195
<dd>
9296
<div class="desc"><p>Orchestrates release process.</p></div>
9397
</dd>
98+
<dt><code class="name"><a title="continuous_delivery_scripts.update_secrets_registry" href="update_secrets_registry.html">continuous_delivery_scripts.update_secrets_registry</a></code></dt>
99+
<dd>
100+
<div class="desc"><p>Record the project's accepted secret registry using detect-secrets.</p></div>
101+
</dd>
94102
<dt><code class="name"><a title="continuous_delivery_scripts.utils" href="utils/index.html">continuous_delivery_scripts.utils</a></code></dt>
95103
<dd>
96104
<div class="desc"><p>Utility scripts to abstract and assist with scripts run in the CI.</p></div>
@@ -114,6 +122,7 @@ <h1>Index</h1>
114122
<ul>
115123
<li><code><a title="continuous_delivery_scripts.assert_news" href="assert_news.html">continuous_delivery_scripts.assert_news</a></code></li>
116124
<li><code><a title="continuous_delivery_scripts.create_news_file" href="create_news_file.html">continuous_delivery_scripts.create_news_file</a></code></li>
125+
<li><code><a title="continuous_delivery_scripts.detect_secrets" href="detect_secrets.html">continuous_delivery_scripts.detect_secrets</a></code></li>
117126
<li><code><a title="continuous_delivery_scripts.generate_docs" href="generate_docs.html">continuous_delivery_scripts.generate_docs</a></code></li>
118127
<li><code><a title="continuous_delivery_scripts.generate_news" href="generate_news.html">continuous_delivery_scripts.generate_news</a></code></li>
119128
<li><code><a title="continuous_delivery_scripts.get_config" href="get_config.html">continuous_delivery_scripts.get_config</a></code></li>
@@ -124,6 +133,7 @@ <h1>Index</h1>
124133
<li><code><a title="continuous_delivery_scripts.report_third_party_ip" href="report_third_party_ip.html">continuous_delivery_scripts.report_third_party_ip</a></code></li>
125134
<li><code><a title="continuous_delivery_scripts.spdx_report" href="spdx_report/index.html">continuous_delivery_scripts.spdx_report</a></code></li>
126135
<li><code><a title="continuous_delivery_scripts.tag_and_release" href="tag_and_release.html">continuous_delivery_scripts.tag_and_release</a></code></li>
136+
<li><code><a title="continuous_delivery_scripts.update_secrets_registry" href="update_secrets_registry.html">continuous_delivery_scripts.update_secrets_registry</a></code></li>
127137
<li><code><a title="continuous_delivery_scripts.utils" href="utils/index.html">continuous_delivery_scripts.utils</a></code></li>
128138
</ul>
129139
</li>

‎docs/plugins/basic.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,7 @@ <h3>Inherited members</h3>
254254
<ul class="hlist">
255255
<li><code><a title="continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.can_get_project_metadata" href="../utils/language_specifics_base.html#continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.can_get_project_metadata">can_get_project_metadata</a></code></li>
256256
<li><code><a title="continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.generate_source_licence_header_template" href="../utils/language_specifics_base.html#continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.generate_source_licence_header_template">generate_source_licence_header_template</a></code></li>
257+
<li><code><a title="continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.get_secret_registry_exclude_files" href="../utils/language_specifics_base.html#continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.get_secret_registry_exclude_files">get_secret_registry_exclude_files</a></code></li>
257258
<li><code><a title="continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.get_version_tag" href="../utils/language_specifics_base.html#continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.get_version_tag">get_version_tag</a></code></li>
258259
<li><code><a title="continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.should_clean_before_packaging" href="../utils/language_specifics_base.html#continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.should_clean_before_packaging">should_clean_before_packaging</a></code></li>
259260
<li><code><a title="continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.should_include_spdx_in_package" href="../utils/language_specifics_base.html#continuous_delivery_scripts.utils.language_specifics_base.BaseLanguage.should_include_spdx_in_package">should_include_spdx_in_package</a></code></li>

0 commit comments

Comments
 (0)