Simple, minimal secrets scanner that I've created for my Forgejo repositories. Slightly more powerful than a bash script abusing grep with regular expressions and slightly less than a full fledged Rust program.
Add "private" headers and path regular expressions to a configuration.json and
pass --config=path/to/configuration.json to the program.
It can be most easily used by wrapping the inquisitor package with the configuration file:
let
configurationFile = writeText "configuration.json" (builtins.toJSON {
headers = [
"AGE-SECRET-KEY"
"BEGIN OPENSSH PRIVATE KEY"
"BEGIN PGP PRIVATE KEY BLOCK"
"PRIVATE"
];
excludePatterns = [
"*/workflows/sensitive.yml"
"*/services/forgejo.nix"
"*/inquisitor/package.nix"
".git/*"
];
});
in
symlinkJoin {
paths = [pkgs.inquisitor];
postBuild = ''
wrapProgram $out/bin/inquisitor \
--add-flags "--config ${configurationFile}"
'';
}