How padok-team/git-secret-scanner works
git-secret-scanner scans repositories across GitHub organizations or GitLab groups, combining TruffleHog’s classification with Gitleaks’ broader detection. The workflow lists repositories, clones or updates each working copy, scans it, merges and filters findings against baseline and fingerprint-ignore inputs, then writes JSON or CSV output. The README also documents comment-based scanner annotations and full-history versus files-only modes. The graph reflects documented capabilities where source excerpts were unavailable; uncertain internal wiring is omitted.
Main entry points: scan.go Scan coordinator · github.go GitHub adapter · gitlab.go GitLab adapter · scm.go Scan commands
Components 20
CLI entry
- Scan commands
cmd/scan/scm.go
SCM providers
- GitHub adapter
cmd/scan/github.go - GitLab adapter
cmd/scan/gitlab.go
Scanning and filtering
- Scan coordinator
internal/scan/scan.go - Git operations
internal/scm/git/clone.go - TruffleHog scanner
internal/scan/scanners/trufflehog/scanner.go - Gitleaks scanner
internal/scan/scanners/gitleaks/scanner.go - Baseline filtering
internal/scan/baseline.go - Fingerprint filtering
internal/scan/fingerprints.go - Task progress
internal/progress/task.go
Results
- Secret model
internal/report/secret/secret.go - Report writers
internal/report
Other components
- Operator
- GitHub API
- GitLab API
- Git remotes
- Working copies
- TruffleHog binary
- Gitleaks binary
- JSON or CSV files
Connections 22
- Operator → Scan commands: selects scan
- Scan commands → GitHub adapter: dispatches
- Scan commands → GitLab adapter: dispatches
- GitHub adapter → Scan coordinator: starts scan
- GitLab adapter → Scan coordinator: starts scan
- GitHub adapter → GitHub API: lists repositories
- GitLab adapter → GitLab API: lists repositories
- Scan coordinator → GitHub adapter: requests repositories
- Scan coordinator → GitLab adapter: requests repositories
- Scan coordinator → Git operations: clones repositories
- Git operations → Git remotes: fetches refs
- Git operations → Working copies: creates or updates
- Scan coordinator → TruffleHog scanner: scans repository
- Scan coordinator → Gitleaks scanner: scans repository
- TruffleHog scanner → TruffleHog binary: executes
- Gitleaks scanner → Gitleaks binary: executes
- Scan coordinator → Baseline filtering: excludes prior findings
- Scan coordinator → Fingerprint filtering: drops ignored findings
- Scan coordinator → Secret model: unions findings
- Scan coordinator → Report writers: writes findings
- Report writers → JSON or CSV files: creates report
- Scan coordinator → Task progress: runs tasks