",
- "
high-verified
",
+ "
verified
",
"
high and above
",
"
medium and above
",
"
low and above
",
@@ -359,9 +363,9 @@ var pageTemplate = strings.Join([]string{
" const normalize = function(value) { return (value || '').toLowerCase(); };",
" function updateNotificationStatus() { if (!('Notification' in window)) { enableNotificationsButton.hidden = true; notificationStatus.textContent = 'Browser notifications are not supported.'; return; } if (Notification.permission === 'granted') { enableNotificationsButton.hidden = true; notificationStatus.textContent = notificationThreshold.value === 'none' ? 'Notifications are off.' : 'Browser notifications enabled.'; return; } if (Notification.permission === 'denied') { enableNotificationsButton.hidden = true; notificationStatus.textContent = 'Notifications are blocked in browser settings.'; return; } enableNotificationsButton.hidden = notificationThreshold.value === 'none'; notificationStatus.textContent = notificationThreshold.value === 'none' ? 'Notifications are off.' : 'Allow notifications for matching findings.'; }",
" function requestNotificationPermission() { if (!('Notification' in window)) { updateNotificationStatus(); return; } try { Notification.requestPermission().then(updateNotificationStatus).catch(updateNotificationStatus); } catch (_) { updateNotificationStatus(); } }",
- " function meetsNotificationThreshold(confidence) { var threshold = notificationThreshold.value; if (threshold === 'none') return false; if (threshold === 'any') return true; var levels = ['high-verified', 'high', 'medium', 'low']; var findingLevel = levels.indexOf(normalize(confidence)); return findingLevel >= 0 && findingLevel <= levels.indexOf(threshold); }",
+ " function meetsNotificationThreshold(confidence) { var threshold = notificationThreshold.value; if (threshold === 'none') return false; if (threshold === 'any') return true; var levels = ['verified', 'high', 'medium', 'low']; var findingLevel = levels.indexOf(normalize(confidence)); return findingLevel >= 0 && findingLevel <= levels.indexOf(threshold); }",
" function closeActiveNotifications() { activeNotifications.forEach(function(notification) { notification.close(); }); activeNotifications = []; }",
- " function notifyFinding(item) { var findingTime = Number(item.timestampMillis); if (!state.notificationsReady || (findingTime > 0 && findingTime < notificationsSince) || !('Notification' in window) || Notification.permission !== 'granted' || !meetsNotificationThreshold(item.confidence)) return; try { var title = item.confidence === 'high-verified' ? 'Verified credential found' : 'Credential finding detected'; var notification = new Notification(title, { body: 'Confidence: ' + (item.confidence || 'unknown') + '. Open Pipeleek to review.' }); activeNotifications.push(notification); notification.onclose = function() { activeNotifications = activeNotifications.filter(function(openNotification) { return openNotification !== notification; }); }; notification.onclick = function() { window.focus(); notification.close(); }; } catch (_) {} }",
+ " function notifyFinding(item) { var findingTime = Number(item.timestampMillis); if (!state.notificationsReady || (findingTime > 0 && findingTime < notificationsSince) || !('Notification' in window) || Notification.permission !== 'granted' || !meetsNotificationThreshold(item.confidence)) return; try { var title = item.confidence === 'verified' ? 'Verified credential found' : 'Credential finding detected'; var notification = new Notification(title, { body: 'Confidence: ' + (item.confidence || 'unknown') + '. Open Pipeleek to review.' }); activeNotifications.push(notification); notification.onclose = function() { activeNotifications = activeNotifications.filter(function(openNotification) { return openNotification !== notification; }); }; notification.onclick = function() { window.focus(); notification.close(); }; } catch (_) {} }",
" function severityClass(value) { return String(value || 'unknown').toLowerCase().replace(/\\s+/g, '-'); }",
" function typeClass(value) { return String(value || 'log').toLowerCase().replace(/\\s+/g, '-'); }",
" function showToast(message) { toast.textContent = message; toast.classList.add('visible'); clearTimeout(showToast.timeout); showToast.timeout = setTimeout(function() { toast.classList.remove('visible'); }, 1200); }",
@@ -372,10 +376,10 @@ var pageTemplate = strings.Join([]string{
" return date.toLocaleString(undefined, { year: 'numeric', month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit', second: '2-digit', hour12: false });",
" }",
" function renderSummary() {",
- " var counts = { low: 0, medium: 0, high: 0, 'high-verified': 0 };",
+ " var counts = { low: 0, medium: 0, high: 0, verified: 0, trufflehog: 0 };",
" state.all.forEach(function(item) { var key = normalize(item.confidence || 'unknown'); if (key in counts) counts[key] += 1; });",
" summaryCards.replaceChildren();",
- " ['high-verified', 'high', 'medium', 'low'].forEach(function(key) { var metric = document.createElement('div'); metric.className = 'metric'; var label = document.createElement('label'); label.textContent = key.charAt(0).toUpperCase() + key.slice(1); var count = document.createElement('strong'); count.textContent = String(counts[key] || 0); metric.append(label, count); summaryCards.appendChild(metric); });",
+ " ['verified', 'high', 'medium', 'low', 'trufflehog'].forEach(function(key) { var metric = document.createElement('div'); metric.className = 'metric'; var label = document.createElement('label'); label.textContent = key.charAt(0).toUpperCase() + key.slice(1); if (key === 'trufflehog') label.title = 'TruffleHog detection without successful verification'; var count = document.createElement('strong'); count.textContent = String(counts[key] || 0); metric.append(label, count); summaryCards.appendChild(metric); });",
" }",
" function filteredFindings() {",
" var query = normalize(searchFilter.value);",
diff --git a/pkg/webui/server_test.go b/pkg/webui/server_test.go
index 5d6e6491..17e2690c 100644
--- a/pkg/webui/server_test.go
+++ b/pkg/webui/server_test.go
@@ -51,6 +51,30 @@ func TestHandleHitAssignsUniqueIDs(t *testing.T) {
}
}
+func TestHandleHitPreservesDetectionLevels(t *testing.T) {
+ for _, confidence := range []string{"verified", "trufflehog"} {
+ s := &Server{clients: make(map[chan string]struct{})}
+ s.handleHit(logging.HitRecord{
+ Time: time.Now(), Confidence: confidence, Value: "fixture",
+ Fields: map[string]interface{}{"engine": "trufflehog"},
+ })
+ if len(s.findings) != 1 || s.findings[0].Confidence != confidence || s.findings[0].Details["engine"] != "trufflehog" {
+ t.Fatal("expected the live finding to preserve its detection level and engine")
+ }
+ data, err := json.Marshal(s.findings[0])
+ if err != nil {
+ t.Fatal(err)
+ }
+ var decoded Finding
+ if err := json.Unmarshal(data, &decoded); err != nil {
+ t.Fatal(err)
+ }
+ if decoded.Confidence != confidence || decoded.Details["engine"] != "trufflehog" {
+ t.Fatal("expected SSE JSON to preserve detection metadata")
+ }
+ }
+}
+
func TestCompletedEventsReplayFindingsAndDone(t *testing.T) {
startedAt := time.Date(2026, time.October, 1, 12, 0, 0, 0, time.UTC)
s := &Server{token: "abc", clients: make(map[chan string]struct{}), startedAt: startedAt}
@@ -133,14 +157,23 @@ func TestHandleRootAllowsInlineScript(t *testing.T) {
if !strings.Contains(body, "Live secret findings") {
t.Fatalf("expected rendered page body, got %q", body)
}
+ if !strings.Contains(body, `data-value="cicd-yaml"`) || !strings.Contains(body, ".badge.type-cicd-yaml") {
+ t.Fatal("missing CI/CD YAML source filter or badge")
+ }
+ if !strings.Contains(body, `data-value="trufflehog"`) || !strings.Contains(body, ".badge.trufflehog") || !strings.Contains(body, "trufflehog: 0") || !strings.Contains(body, "['verified', 'high', 'medium', 'low', 'trufflehog']") {
+ t.Fatal("expected a neutral TruffleHog candidate filter, badge and summary count")
+ }
+ if !strings.Contains(body, "var levels = ['verified', 'high', 'medium', 'low']") || strings.Contains(body, "high-verified") || strings.Contains(body, "trufflehog-unverified") {
+ t.Fatal("expected migrated notification ranking without ranking TruffleHog candidates as verified")
+ }
if !strings.Contains(body, "No findings yet. Results will appear here as the scan runs.") || !strings.Contains(body, "No findings were detected.") || !strings.Contains(body, "No findings match the current filters.") {
t.Fatal("expected distinct empty states for an active scan, a completed scan, and filtered results")
}
if !strings.Contains(body, "id=\"elapsed-time\"") || !strings.Contains(body, "var elapsedBase = ") || !strings.Contains(body, "window.setInterval(updateElapsedTime, 1000)") {
t.Fatal("expected elapsed timer element, server-provided baseline, and periodic updates")
}
- if !strings.Contains(body, `id="notification-threshold-picker"`) || !strings.Contains(body, `aria-multiselectable="false"`) || !strings.Contains(body, `data-value="high-verified" aria-selected="true"`) || !strings.Contains(body, `data-value="none" aria-selected="false"`) || !strings.Contains(body, `class="badge high-verified">high-verified`) || !strings.Contains(body, `id="enable-notifications"`) {
- t.Fatal("expected single-select badge picker with high-verified default, None option, and permission fallback control")
+ if !strings.Contains(body, `id="notification-threshold-picker"`) || !strings.Contains(body, `aria-multiselectable="false"`) || !strings.Contains(body, `data-value="verified" aria-selected="true"`) || !strings.Contains(body, `data-value="none" aria-selected="false"`) || !strings.Contains(body, `class="badge verified">verified`) || !strings.Contains(body, `id="enable-notifications"`) {
+ t.Fatal("expected single-select badge picker with verified default, None option, and permission fallback control")
}
if strings.Index(body, `id="notification-status"`) < strings.Index(body, `id="notification-threshold-picker"`) {
t.Fatal("expected notification status to appear after its threshold picker")
@@ -151,8 +184,8 @@ func TestHandleRootAllowsInlineScript(t *testing.T) {
if !strings.Contains(body, "notificationsSince = Date.now(); closeActiveNotifications()") || !strings.Contains(body, "Number(item.timestampMillis)") || !strings.Contains(body, "findingTime < notificationsSince") || !strings.Contains(body, "function closeActiveNotifications()") {
t.Fatal("expected threshold changes to close and suppress already-queued notifications")
}
- if !strings.Contains(body, `id="notification-threshold" type="hidden" value="high-verified"`) || strings.Contains(body, "document.cookie") || strings.Contains(body, "localStorage") {
- t.Fatal("expected the notification threshold to reset to high-verified for each new WebUI page")
+ if !strings.Contains(body, `id="notification-threshold" type="hidden" value="verified"`) || strings.Contains(body, "document.cookie") || strings.Contains(body, "localStorage") {
+ t.Fatal("expected the notification threshold to reset to verified for each new WebUI page")
}
if strings.Contains(body, "tableBody.innerHTML") || !strings.Contains(body, "function appendDetailValue") || !strings.Contains(body, "parsed.protocol === 'http:' || parsed.protocol === 'https:'") {
t.Fatal("expected finding values to render via DOM text APIs with HTTP(S)-only links")
@@ -169,7 +202,7 @@ func TestHandleRootAllowsInlineScript(t *testing.T) {
if !strings.Contains(body, ".filters { display: flex; flex-wrap: wrap; gap: .75rem; align-items: flex-start; }") || !strings.Contains(body, ".filters > .control-btn { align-self: flex-start; margin-top: 1.5rem; }") {
t.Fatal("expected filter labels to align at the top while action buttons align with the controls")
}
- if strings.Count(body, `aria-multiselectable="true"`) != 2 || !strings.Contains(body, `class="badge high-verified">high-verified`) {
+ if strings.Count(body, `aria-multiselectable="true"`) != 2 || !strings.Contains(body, `class="badge verified">verified`) {
t.Fatal("expected severity and type filters to render badge-style multi-select options")
}
if !strings.Contains(body, `id="toggle-full-width"`) || !strings.Contains(body, "main.main-wide") {
@@ -305,7 +338,7 @@ func TestExportCSVPreservesSpecialValues(t *testing.T) {
{
Time: "2026-10-01T12:34:56Z",
Type: "log",
- Confidence: "high",
+ Confidence: "trufflehog",
RuleName: `rule, with "quotes"`,
Value: "first line,\r\nsecond line \"quoted\" 雪",
Details: map[string]string{
@@ -316,7 +349,7 @@ func TestExportCSVPreservesSpecialValues(t *testing.T) {
{
Time: "2026-10-01T12:35:00Z",
Type: "dotenv",
- Confidence: "low",
+ Confidence: "verified",
RuleName: "formula value",
Value: "\t=1+1",
},
@@ -345,6 +378,9 @@ func TestExportCSVPreservesSpecialValues(t *testing.T) {
if len(records) != 3 {
t.Fatalf("expected header and two findings, got %d records", len(records))
}
+ if records[1][0] != "trufflehog" || records[2][0] != "verified" {
+ t.Fatal("expected CSV export to preserve the detection levels")
+ }
if got, want := records[1][1], findings[0].RuleName; got != want {
t.Errorf("rule name mismatch: got %q, want %q", got, want)
}
diff --git a/tests/e2e/bitbucket/scan/artifacts_test.go b/tests/e2e/bitbucket/scan/artifacts_test.go
index 36a256aa..e5b2fb50 100644
--- a/tests/e2e/bitbucket/scan/artifacts_test.go
+++ b/tests/e2e/bitbucket/scan/artifacts_test.go
@@ -159,6 +159,7 @@ SENDGRID_API_KEY=SG.1234567890abcdefghijklmnopqrstuvwxyz
assert.Contains(t, output, "credentials.txt", "Should scan credentials file in small artifact")
}
func TestBitBucketScan_Artifacts_WithDotEnv(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
@@ -442,6 +443,7 @@ ADMIN_PASSWORD=SuperSecretAdminPass123!
}
func TestBitBucketScan_Artifacts_MultipleFiles(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
@@ -631,6 +633,7 @@ func TestBitBucketScan_Cookie_WithoutArtifacts(t *testing.T) {
}
func TestBitBucketScan_DownloadArtifacts(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
diff --git a/tests/e2e/bitbucket/scan/basic_test.go b/tests/e2e/bitbucket/scan/basic_test.go
index e629ef37..8c8a36b8 100644
--- a/tests/e2e/bitbucket/scan/basic_test.go
+++ b/tests/e2e/bitbucket/scan/basic_test.go
@@ -13,6 +13,7 @@ import (
)
func TestBitBucketScan_HappyPath(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
diff --git a/tests/e2e/bitbucket/scan/unknown_archive_test.go b/tests/e2e/bitbucket/scan/unknown_archive_test.go
index 93a7c11e..3367c823 100644
--- a/tests/e2e/bitbucket/scan/unknown_archive_test.go
+++ b/tests/e2e/bitbucket/scan/unknown_archive_test.go
@@ -16,6 +16,7 @@ import (
// TestBitBucketScan_UnknownArchive_BinaryWithSecrets tests that when encountering
// an unknown archive file type, the scanner extracts printable strings and scans them
func TestBitBucketScan_UnknownArchive_BinaryWithSecrets(t *testing.T) {
+ testutil.UseTestRules(t)
// Create a binary file that is not a recognizable archive format
// but contains embedded secrets (simulating a compiled binary or proprietary format)
@@ -156,6 +157,7 @@ func TestBitBucketScan_UnknownArchive_BinaryWithSecrets(t *testing.T) {
// TestBitBucketScan_UnknownArchive_ELFBinary tests string extraction from ELF binary format
func TestBitBucketScan_UnknownArchive_ELFBinary(t *testing.T) {
+ testutil.UseTestRules(t)
// Create an ELF-like binary with embedded secrets
var elfBinary bytes.Buffer
@@ -279,6 +281,7 @@ func TestBitBucketScan_UnknownArchive_ELFBinary(t *testing.T) {
// TestBitBucketScan_UnknownArchive_MixedBinaryFormats tests handling of multiple unknown formats
func TestBitBucketScan_UnknownArchive_MixedBinaryFormats(t *testing.T) {
+ testutil.UseTestRules(t)
// Binary 1: Proprietary format with secret
binary1 := []byte{
diff --git a/tests/e2e/devops/scan/scan_test.go b/tests/e2e/devops/scan/scan_test.go
index 7c7ae006..94e8afa7 100644
--- a/tests/e2e/devops/scan/scan_test.go
+++ b/tests/e2e/devops/scan/scan_test.go
@@ -62,6 +62,7 @@ func TestAzureDevOpsScan_HappyPath(t *testing.T) {
// TestAzureDevOpsScan_MissingToken tests missing required token
func TestAzureDevOpsScan_WithLogs(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
@@ -137,6 +138,7 @@ func TestAzureDevOpsScan_WithLogs(t *testing.T) {
}
func TestAzureDevOpsScan_Artifacts_WithDotEnv(t *testing.T) {
+ testutil.UseTestRules(t)
// Create a zip with a .env file
var zipBuf bytes.Buffer
diff --git a/tests/e2e/github/scan/advanced_test.go b/tests/e2e/github/scan/advanced_test.go
index 2ca4fe78..ea5c9155 100644
--- a/tests/e2e/github/scan/advanced_test.go
+++ b/tests/e2e/github/scan/advanced_test.go
@@ -204,8 +204,8 @@ func TestGitHubScan_RateLimit(t *testing.T) {
}
// TestGitHubScan_ConfidenceFilter tests multiple confidence levels
-// SKIP: Test intermittently times out - needs investigation of zip handling in mock environment
func TestGitHubScan_ConfidenceFilter(t *testing.T) {
+ testutil.UseTestRules(t)
// Prepare zipped logs with secrets
var logsZip bytes.Buffer
diff --git a/tests/e2e/github/scan/artifacts_test.go b/tests/e2e/github/scan/artifacts_test.go
index 38786cb3..00f4b711 100644
--- a/tests/e2e/github/scan/artifacts_test.go
+++ b/tests/e2e/github/scan/artifacts_test.go
@@ -13,6 +13,7 @@ import (
)
func TestGitHubScan_Artifacts_WithDotEnv(t *testing.T) {
+ testutil.UseTestRules(t)
// Create artifact zip with a .env file
var artifactZipBuf bytes.Buffer
@@ -302,6 +303,7 @@ AWS_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
// TestGitHubScan_Artifacts_NestedArchive tests nested zip handling
func TestGitHubScan_Artifacts_NestedArchive(t *testing.T) {
+ testutil.UseTestRules(t)
// Create inner zip with secret
var innerZipBuf bytes.Buffer
diff --git a/tests/e2e/github/scan/local_rules_test.go b/tests/e2e/github/scan/local_rules_test.go
new file mode 100644
index 00000000..8b60bb7f
--- /dev/null
+++ b/tests/e2e/github/scan/local_rules_test.go
@@ -0,0 +1,143 @@
+package e2e
+
+import (
+ "archive/zip"
+ "bytes"
+ "encoding/json"
+ "net/http"
+ "os"
+ "path/filepath"
+ "strings"
+ "testing"
+ "time"
+
+ "github.com/CompassSecurity/pipeleek/tests/e2e/internal/testutil"
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+)
+
+func TestGitHubScan_LocalRulesAndLevels(t *testing.T) {
+ require.True(t, filepath.IsAbs(os.Getenv("PIPELEEK_BINARY")), "Use an absolute PIPELEEK_BINARY for isolated working-directory tests")
+ dir := t.TempDir()
+ t.Chdir(dir)
+ archive := func(name, content string) []byte {
+ var buffer bytes.Buffer
+ writer := zip.NewWriter(&buffer)
+ file, err := writer.Create(name)
+ require.NoError(t, err)
+ _, err = file.Write([]byte(content))
+ require.NoError(t, err)
+ require.NoError(t, writer.Close())
+ return buffer.Bytes()
+ }
+ logs := archive("job.log", "GITLAB_USER_ID=19357\nGITLAB_TOKEN=glpat-abcdefghijklmnopqrst\nPIPELEEK_LOG_FIXTURE\n")
+ artifact := archive("settings.txt", "KUBECONFIG=/tmp/local-config\nPIPELEEK_ARTIFACT_FIXTURE\n")
+ server, requests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
+ switch r.URL.Path {
+ case "/api/v3/user/repos":
+ testutil.JSON(w, http.StatusOK, []map[string]interface{}{{
+ "id": 1, "name": "test-repo", "full_name": "user/test-repo",
+ "html_url": "https://example.test/user/test-repo",
+ "owner": map[string]interface{}{"login": "user"},
+ }})
+ case "/api/v3/repos/user/test-repo/actions/runs":
+ testutil.JSON(w, http.StatusOK, map[string]interface{}{
+ "total_count": 1,
+ "workflow_runs": []map[string]interface{}{{
+ "id": 100, "name": "Local rules", "status": "completed", "display_title": "Local rules",
+ "html_url": "https://example.test/runs/100",
+ "repository": map[string]interface{}{"name": "test-repo", "owner": map[string]interface{}{"login": "user"}},
+ }},
+ })
+ case "/api/v3/repos/user/test-repo/actions/runs/100/jobs":
+ testutil.JSON(w, http.StatusOK, map[string]interface{}{"jobs": []map[string]interface{}{{"id": 1000, "name": "fixture-job"}}, "total_count": 1})
+ case "/api/v3/repos/user/test-repo/actions/runs/100/logs":
+ w.Header().Set("Location", "http://"+r.Host+"/download/logs.zip")
+ w.WriteHeader(http.StatusFound)
+ case "/download/logs.zip":
+ w.Header().Set("Content-Type", "application/zip")
+ _, _ = w.Write(logs)
+ case "/api/v3/repos/user/test-repo/actions/runs/100/artifacts":
+ testutil.JSON(w, http.StatusOK, map[string]interface{}{
+ "artifacts": []map[string]interface{}{{
+ "id": 1, "name": "fixture-output",
+ "archive_download_url": "http://" + r.Host + "/api/v3/repos/user/test-repo/actions/artifacts/1/zip",
+ }}, "total_count": 1,
+ })
+ case "/api/v3/repos/user/test-repo/actions/artifacts/1/zip":
+ w.Header().Set("Location", "http://"+r.Host+"/download/artifact.zip")
+ w.WriteHeader(http.StatusFound)
+ case "/download/artifact.zip":
+ w.Header().Set("Content-Type", "application/zip")
+ _, _ = w.Write(artifact)
+ default:
+ testutil.JSON(w, http.StatusOK, map[string]interface{}{})
+ }
+ })
+ defer cleanup()
+
+ run := func(confidence string) []map[string]interface{} {
+ t.Helper()
+ args := []string{"gh", "scan", "--url", server.URL, "--token", "fixture-token", "--owned", "--artifacts", "--secrets-verification=false", "--json", "--verbose"}
+ if confidence != "" {
+ args = append(args, "--confidence="+confidence)
+ }
+ stdout, stderr, err := testutil.RunCLI(t, args, nil, time.Minute)
+ require.NoError(t, err, stdout+stderr)
+ var findings []map[string]interface{}
+ for _, line := range strings.Split(stdout+"\n"+stderr, "\n") {
+ var record map[string]interface{}
+ if json.Unmarshal([]byte(line), &record) == nil && record["message"] == "SECRET" {
+ findings = append(findings, record)
+ }
+ }
+ return findings
+ }
+ has := func(findings []map[string]interface{}, confidence, value string) bool {
+ for _, finding := range findings {
+ text, ok := finding["value"].(string)
+ if ok && finding["confidence"] == confidence && strings.Contains(text, value) {
+ return true
+ }
+ }
+ return false
+ }
+ findings := run("")
+ assert.True(t, has(findings, "medium", "GITLAB_USER_ID=19357"), "Retain the identifier rule without a local rules file")
+ assert.True(t, has(findings, "medium", "KUBECONFIG=/tmp/local-config"), "Retain path matching in artifacts")
+ assert.True(t, has(findings, "trufflehog", "glpat-abcdefghijklmnopqrst"), "Offline TruffleHog candidates use the new level")
+ _, err := os.Stat(filepath.Join(dir, "rules.yml"))
+ assert.True(t, os.IsNotExist(err), "Scanning must not create or download rules")
+ assert.Empty(t, run("verified"), "Offline fixtures must not become verified")
+ candidates := run("trufflehog")
+ require.NotEmpty(t, candidates)
+ for _, finding := range candidates {
+ assert.Equal(t, "trufflehog", finding["confidence"])
+ assert.Equal(t, "trufflehog", finding["engine"])
+ }
+
+ custom := []byte(`patterns:
+ - pattern:
+ name: Gitlab - Predefined Environment Variable
+ regex: PIPELEEK_(LOG|ARTIFACT)_FIXTURE
+ confidence: custom-confidence
+`)
+ require.NoError(t, os.WriteFile(filepath.Join(dir, "rules.yml"), custom, 0600))
+ findings = run("custom-confidence,medium")
+ assert.True(t, has(findings, "custom-confidence", "PIPELEEK_LOG_FIXTURE"))
+ assert.True(t, has(findings, "custom-confidence", "PIPELEEK_ARTIFACT_FIXTURE"))
+ for _, finding := range findings {
+ assert.Equal(t, "custom-confidence", finding["confidence"], "The overridden variable rule must not emit medium findings")
+ }
+ unchanged, err := os.ReadFile(filepath.Join(dir, "rules.yml"))
+ require.NoError(t, err)
+ assert.Equal(t, custom, unchanged)
+ assert.NotEmpty(t, requests())
+
+ require.NoError(t, os.WriteFile(filepath.Join(dir, "rules.yml"), []byte("patterns:\n- pattern: {name: InvalidFixture, regex: '[', confidence: high}\n"), 0600))
+ stdout, stderr, err := testutil.RunCLI(t, []string{"gh", "scan", "--url", server.URL, "--token", "fixture-token", "--secrets-verification=false"}, nil, time.Minute)
+ require.Error(t, err)
+ assert.Contains(t, stdout+stderr, "InvalidFixture")
+ assert.Contains(t, stdout+stderr, "invalid regex")
+ assert.Contains(t, stdout+stderr, "Failed loading rules")
+}
diff --git a/tests/e2e/github/scan/logs_test.go b/tests/e2e/github/scan/logs_test.go
index 84a978e9..c3b9a296 100644
--- a/tests/e2e/github/scan/logs_test.go
+++ b/tests/e2e/github/scan/logs_test.go
@@ -112,6 +112,7 @@ func TestGitHubScan_HappyPath(t *testing.T) {
// TestGitHubScan_MissingToken tests missing required flags
func TestGitHubScan_WithLogs(t *testing.T) {
+ testutil.UseTestRules(t)
// prepare zipped logs (single file inside ZIP)
var logsZip bytes.Buffer
diff --git a/tests/e2e/github/scan/unknown_archive_test.go b/tests/e2e/github/scan/unknown_archive_test.go
index 117a1bfb..3897a935 100644
--- a/tests/e2e/github/scan/unknown_archive_test.go
+++ b/tests/e2e/github/scan/unknown_archive_test.go
@@ -17,6 +17,7 @@ import (
// TestGitHubScan_UnknownArchive_BinaryWithSecrets tests that when encountering
// an unknown archive file type, the scanner extracts printable strings and scans them
func TestGitHubScan_UnknownArchive_BinaryWithSecrets(t *testing.T) {
+ testutil.UseTestRules(t)
// Create a binary file that is not a recognizable archive format
// but contains embedded secrets (simulating a compiled binary or proprietary format)
diff --git a/tests/e2e/gitlab/cicd/scan/scan_test.go b/tests/e2e/gitlab/cicd/scan/scan_test.go
index 2a773e3d..1a35f98c 100644
--- a/tests/e2e/gitlab/cicd/scan/scan_test.go
+++ b/tests/e2e/gitlab/cicd/scan/scan_test.go
@@ -20,14 +20,14 @@ func TestGLCicdScan_HappyPath(t *testing.T) {
case "/api/v4/projects":
w.WriteHeader(http.StatusOK)
_ = json.NewEncoder(w).Encode([]map[string]interface{}{
- {"id": 1, "name": "test-project", "path_with_namespace": "group/test-project"},
+ {"id": 1, "name": "test-project", "path_with_namespace": "group/test-project", "web_url": "https://gitlab.example/group/test-project"},
})
case "/api/v4/projects/1/ci/lint":
w.WriteHeader(http.StatusOK)
_, _ = w.Write([]byte(`{
"valid": true,
- "merged_yaml": "deploy:\n script:\n - echo AKIAIOSFODNN7EXAMPLE\n",
+ "merged_yaml": "deploy:\n script:\n - echo GITLAB_USER_ID=19357\n",
"warnings": [],
"errors": []
}`))
@@ -43,10 +43,16 @@ func TestGLCicdScan_HappyPath(t *testing.T) {
"gl", "cicd", "scan",
"--url", server.URL,
"--token", "glpat-test-token-123",
+ "--secrets-verification=false",
+ "--confidence=medium",
+ "--json",
}, nil, 10*time.Second)
assert.Nil(t, exitErr, "Command should succeed")
- assert.Contains(t, stdout, "AKIAIOSFODNN7EXAMPLE", "Should detect the secret embedded in the CI/CD YAML")
+ assert.Contains(t, stdout, "GITLAB_USER_ID=19357", "Should detect the indicator embedded in the CI/CD YAML")
+ assert.Contains(t, stdout, `"type":"cicd-yaml"`)
+ assert.Contains(t, stdout, `"url":"https://gitlab.example/group/test-project/-/blob/HEAD/.gitlab-ci.yml"`)
+ assert.NotContains(t, stdout, `"type":"log"`)
requests := getRequests()
for _, req := range requests {
diff --git a/tests/e2e/gitlab/renovate/renovate_test.go b/tests/e2e/gitlab/renovate/renovate_test.go
index ea9a506f..c0bd1c1d 100644
--- a/tests/e2e/gitlab/renovate/renovate_test.go
+++ b/tests/e2e/gitlab/renovate/renovate_test.go
@@ -573,7 +573,7 @@ func runRenovateProbeWithHostNpx(t *testing.T, repoDir, endpoint string) string
)
output, err := cmd.CombinedOutput()
if err != nil {
- return string(output)
+ t.Fatalf("host Renovate probe failed: %v\n%s", err, output)
}
return string(output)
}
@@ -819,6 +819,9 @@ func tailForDiagnostics(value string, max int) string {
func TestGLRenovateAutodiscovery_RenovateLatestPicksUpMavenWrapperExploit(t *testing.T) {
skipRenovateContainerProbeIfUnavailable(t)
+ if _, err := exec.LookPath("npx"); err != nil {
+ t.Skipf("Skipping host Renovate probe because npx is unavailable: %v", err)
+ }
filesSnapshot := captureAutodiscoveryRepoFiles(t)
repoDir := materializeAutodiscoveryRepoFixture(t, filesSnapshot)
cloneURL := startGitDaemonForRepo(t, repoDir)
diff --git a/tests/e2e/gitlab/scan/errors_test.go b/tests/e2e/gitlab/scan/errors_test.go
index 6a9d31d1..608221be 100644
--- a/tests/e2e/gitlab/scan/errors_test.go
+++ b/tests/e2e/gitlab/scan/errors_test.go
@@ -61,6 +61,22 @@ func TestGitLabScan_JobStatusSkipsProjectErrors(t *testing.T) {
}
}
+func TestGitLabScan_RejectsSpaceSeparatedBooleanValue(t *testing.T) {
+ server, requests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
+ t.Errorf("Invalid arguments must not trigger API requests: %s", r.URL)
+ w.WriteHeader(http.StatusInternalServerError)
+ })
+ defer cleanup()
+ stdout, stderr, err := testutil.RunCLI(t, []string{
+ "gl", "scan", "--url", server.URL, "--token", "fixture-token",
+ "--secrets-verification", "false",
+ }, nil, 10*time.Second)
+ require.Error(t, err)
+ assert.Contains(t, stdout+stderr, "--secrets-verification=false")
+ assert.NotContains(t, stdout+stderr, "Setting up queue")
+ assert.Empty(t, requests(), "Argument validation must happen before any provider checks")
+}
+
func TestGitLabScan_PipelineSourceSkipsDeletedResources(t *testing.T) {
for _, resource := range []string{"project", "pipeline"} {
t.Run(resource, func(t *testing.T) {
diff --git a/tests/e2e/gitlab/scan/scan_test.go b/tests/e2e/gitlab/scan/scan_test.go
index c83d5831..4f06c6dd 100644
--- a/tests/e2e/gitlab/scan/scan_test.go
+++ b/tests/e2e/gitlab/scan/scan_test.go
@@ -254,6 +254,7 @@ func TestGitLabScan_FlagVariations(t *testing.T) {
// TestGitLabScan_ScansCICDYaml verifies the scan command fetches and scans the
// project's merged .gitlab-ci.yml for secrets via the CI lint API.
func TestGitLabScan_ScansCICDYaml(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
diff --git a/tests/e2e/gitlab/snippets/snippets_test.go b/tests/e2e/gitlab/snippets/snippets_test.go
index 84df0ca3..51d4ec08 100644
--- a/tests/e2e/gitlab/snippets/snippets_test.go
+++ b/tests/e2e/gitlab/snippets/snippets_test.go
@@ -15,6 +15,7 @@ import (
const awsSnippetContent = "[default]\naws_access_key_id = AKIAT4GVSAXXEK64O6KD\naws_secret_access_key = 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\n"
func TestGitLabSnippetsScan_PublicSnippets(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
@@ -69,6 +70,7 @@ func TestGitLabSnippetsScan_PublicSnippets(t *testing.T) {
}
func TestGitLabSnippetsScan_MemberFilter(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
@@ -131,6 +133,7 @@ func TestGitLabSnippetsScan_MemberFilter(t *testing.T) {
}
func TestGitLabSnippetsScan_ProjectFilter(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
@@ -192,6 +195,7 @@ func TestGitLabSnippetsScan_ProjectFilter(t *testing.T) {
}
func TestGitLabSnippetsScan_GroupFilter(t *testing.T) {
+ testutil.UseTestRules(t)
server, getRequests, cleanup := testutil.StartMockServerWithRecording(t, func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
diff --git a/tests/e2e/internal/testutil/scan_rules.go b/tests/e2e/internal/testutil/scan_rules.go
new file mode 100644
index 00000000..616cdd8a
--- /dev/null
+++ b/tests/e2e/internal/testutil/scan_rules.go
@@ -0,0 +1,21 @@
+package testutil
+
+import (
+ _ "embed"
+ "os"
+ "testing"
+)
+
+//go:embed testdata/scan-rules.yaml
+var scanRules []byte
+
+// UseTestRules isolates transport/pipeline tests from downloaded rule databases
+// and provider verification. Detection policy is tested separately.
+func UseTestRules(t *testing.T) {
+ t.Helper()
+ t.Chdir(t.TempDir())
+ t.Setenv("PIPELEEK_COMMON_SECRETS_VERIFICATION", "false")
+ if err := os.WriteFile("rules.yml", scanRules, 0600); err != nil {
+ t.Fatalf("write scan fixture rules: %v", err)
+ }
+}
diff --git a/tests/e2e/internal/testutil/testdata/scan-rules.yaml b/tests/e2e/internal/testutil/testdata/scan-rules.yaml
new file mode 100644
index 00000000..5b622c01
--- /dev/null
+++ b/tests/e2e/internal/testutil/testdata/scan-rules.yaml
@@ -0,0 +1,22 @@
+# Deterministic fixture matchers, not production credential detectors.
+patterns:
+ - pattern:
+ name: Password in URL
+ regex: '(postgres|postgresql|mysql)://[^\s"<>]+'
+ confidence: high
+ - pattern:
+ name: Github Personal Access Token
+ regex: 'ghp_[A-Za-z0-9]+'
+ confidence: high
+ - pattern:
+ name: Stripe Secret Key
+ regex: 'sk_(live|test)_[A-Za-z0-9]+'
+ confidence: high
+ - pattern:
+ name: AWS Fixture
+ regex: '(AKIA[A-Z0-9]{16}|AWS_SECRET_ACCESS_KEY[^\r\n]+)'
+ confidence: high
+ - pattern:
+ name: Assignment Fixture
+ regex: '(DATABASE_PASSWORD|GITLAB_TOKEN|JWT_SECRET|ENCRYPTION_KEY)=[^\r\n]+'
+ confidence: medium
diff --git a/tests/e2e/rules/download_test.go b/tests/e2e/rules/download_test.go
new file mode 100644
index 00000000..0131a1ae
--- /dev/null
+++ b/tests/e2e/rules/download_test.go
@@ -0,0 +1,98 @@
+package rules
+
+import (
+ "io"
+ "net"
+ "net/http"
+ "net/http/httptest"
+ "os"
+ "path/filepath"
+ "testing"
+ "time"
+
+ "github.com/CompassSecurity/pipeleek/tests/e2e/internal/testutil"
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+ "gopkg.in/yaml.v3"
+)
+
+func TestRulesDownload(t *testing.T) {
+ require.True(t, filepath.IsAbs(os.Getenv("PIPELEEK_BINARY")))
+ t.Chdir(t.TempDir())
+ const fixture = "patterns:\n - pattern:\n name: Fixture\n regex: FIXTURE_[A-Z]+\n confidence: high\n"
+ backend := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ assert.Equal(t, "/mazen160/secrets-patterns-db/master/db/rules-stable.yml", r.URL.Path)
+ _, _ = w.Write([]byte(fixture))
+ }))
+ defer backend.Close()
+ proxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ if !assert.Equal(t, http.MethodConnect, r.Method) || !assert.Equal(t, "raw.githubusercontent.com:443", r.Host) {
+ w.WriteHeader(http.StatusBadRequest)
+ return
+ }
+ upstream, err := net.DialTimeout("tcp", backend.Listener.Addr().String(), 5*time.Second)
+ if !assert.NoError(t, err) {
+ w.WriteHeader(http.StatusBadGateway)
+ return
+ }
+ defer upstream.Close()
+ conn, buffer, err := w.(http.Hijacker).Hijack()
+ if !assert.NoError(t, err) {
+ return
+ }
+ defer conn.Close()
+ _, err = conn.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
+ if !assert.NoError(t, err) {
+ return
+ }
+ go func() { _, _ = io.Copy(upstream, buffer) }()
+ _, _ = io.Copy(conn, upstream)
+ }))
+ defer proxy.Close()
+ run := func(extra ...string) (string, error) {
+ t.Helper()
+ args := append([]string{"rules", "download", "--proxy", proxy.URL, "--http-timeout", "10s"}, extra...)
+ stdout, stderr, err := testutil.RunCLI(t, args, nil, 30*time.Second)
+ return stdout + stderr, err
+ }
+ output, err := run()
+ require.NoError(t, err, output)
+ assert.Contains(t, output, "Downloaded optional rules")
+ data, err := os.ReadFile("rules.yml")
+ require.NoError(t, err)
+ require.Equal(t, fixture, string(data))
+
+ require.NoError(t, os.WriteFile("rules.yml", []byte("original"), 0600))
+ output, err = run()
+ require.Error(t, err, output)
+ assert.Contains(t, output, "--force")
+ data, err = os.ReadFile("rules.yml")
+ require.NoError(t, err)
+ require.Equal(t, "original", string(data))
+
+ output, err = run("--force")
+ require.NoError(t, err, output)
+ data, err = os.ReadFile("rules.yml")
+ require.NoError(t, err)
+ require.Equal(t, fixture, string(data))
+
+ output, err = run("--output", "custom.yml")
+ require.NoError(t, err, output)
+ data, err = os.ReadFile("custom.yml")
+ require.NoError(t, err)
+ require.Equal(t, fixture, string(data))
+
+ stdout, stderr, err := testutil.RunCLI(t, []string{"config", "gen"}, nil, 30*time.Second)
+ require.NoError(t, err, stderr)
+ var generated struct {
+ Rules struct {
+ Download struct {
+ Output string
+ Force bool
+ }
+ }
+ }
+ require.NoError(t, yaml.Unmarshal([]byte(stdout), &generated))
+ require.Equal(t, "rules.yml", generated.Rules.Download.Output)
+ require.False(t, generated.Rules.Download.Force)
+}