From 710930f458f4178a284ccead61db1c9fcd6e354f Mon Sep 17 00:00:00 2001 From: Daniel A Martinez Julio Date: Fri, 19 Jun 2026 09:04:01 -0700 Subject: [PATCH] stamp: map gitleaks + trufflehog results to hardcoded-secret class --- .github/scripts/sigilix_sarif_contract.py | 5 +++++ .github/scripts/sigilix_sarif_test.py | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/.github/scripts/sigilix_sarif_contract.py b/.github/scripts/sigilix_sarif_contract.py index 5ecf29b..0ab7dfb 100644 --- a/.github/scripts/sigilix_sarif_contract.py +++ b/.github/scripts/sigilix_sarif_contract.py @@ -282,6 +282,11 @@ def _sanitize_run_results(run): } # OpenGrep runs the same rulesets as Semgrep → reuse the patterns. _RULE_CLASS_PATTERNS["opengrep"] = _RULE_CLASS_PATTERNS["semgrep"] +# Dedicated secret scanners only ever report hardcoded secrets, so every result +# maps to `hardcoded-secret` (`.+` = any non-empty ruleId). The exactly-one-class +# guard keeps this collision-safe. +_RULE_CLASS_PATTERNS["gitleaks"] = [(re.compile(r".+"), "hardcoded-secret")] +_RULE_CLASS_PATTERNS["trufflehog"] = [(re.compile(r".+"), "hardcoded-secret")] def stamp_rule_classes(run, tool_id): diff --git a/.github/scripts/sigilix_sarif_test.py b/.github/scripts/sigilix_sarif_test.py index fda8111..b7dbdb9 100644 --- a/.github/scripts/sigilix_sarif_test.py +++ b/.github/scripts/sigilix_sarif_test.py @@ -977,6 +977,12 @@ def test_collision_safe_unset_when_two_classes_match(self): # A contrived ruleId hitting two patterns → exactly-one guard leaves it unset. self.assertIsNone(self._run("sql-injection-and-ssrf-combo")) + def test_secret_scanners_map_to_hardcoded_secret(self): + for tool in ("gitleaks", "trufflehog"): + run = {"tool": {"driver": {}}, "results": [{"ruleId": "aws-access-token", "properties": {}}]} + stamp_rule_classes(run, tool) + self.assertEqual(run["results"][0]["properties"]["sigilixRuleClass"], "hardcoded-secret") + def test_unknown_tool_id_strips_only(self): run = {"tool": {"driver": {}}, "results": [{"ruleId": "dangerous-exec", "properties": {"sigilixRuleClass": "x"}}]} stamp_rule_classes(run, "eslint") # no patterns for eslint → strip only