# padok-team/git-secret-scanner architecture

> Architecture diagram of the GitHub repository padok-team/git-secret-scanner, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/padok-team/git-secret-scanner
- Repository: https://github.com/padok-team/git-secret-scanner

## Overview

git-secret-scanner scans repositories across GitHub organizations or GitLab groups, combining TruffleHog’s classification with Gitleaks’ broader detection. The workflow lists repositories, clones or updates each working copy, scans it, merges and filters findings against baseline and fingerprint-ignore inputs, then writes JSON or CSV output. The README also documents comment-based scanner annotations and full-history versus files-only modes. The graph reflects documented capabilities where source excerpts were unavailable; uncertain internal wiring is omitted.

Main entry points: [`internal/scan/scan.go`](https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/scan.go) (Scan coordinator), [`cmd/scan/github.go`](https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/github.go) (GitHub adapter), [`cmd/scan/gitlab.go`](https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/gitlab.go) (GitLab adapter), [`cmd/scan/scm.go`](https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/scm.go) (Scan commands)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI entry"]
  node_commands["Scan commands<br/>[scm.go]"]
end

subgraph group_providers["SCM providers"]
  node_github_adapter["GitHub adapter<br/>[github.go]"]
  node_gitlab_adapter["GitLab adapter<br/>[gitlab.go]"]
end

subgraph group_scan["Scanning and filtering"]
  node_scan_runner["Scan coordinator<br/>[scan.go]"]
  node_git_ops["Git operations<br/>[clone.go]"]
  node_trufflehog["TruffleHog scanner<br/>[scanner.go]"]
  node_gitleaks["Gitleaks scanner<br/>[scanner.go]"]
  node_baseline["Baseline filtering<br/>[baseline.go]"]
  node_fingerprints["Fingerprint filtering<br/>[fingerprints.go]"]
  node_progress["Task progress<br/>[task.go]"]
end

subgraph group_output["Results"]
  node_secret_model["Secret model<br/>[secret.go]"]
  node_report_writer["Report writers"]
end

node_operator(("Operator"))
node_github_api["GitHub API"]
node_gitlab_api["GitLab API"]
node_git_remote["Git remotes"]
node_working_copy["Working copies"]
node_trufflehog_bin["TruffleHog binary"]
node_gitleaks_bin["Gitleaks binary"]
node_report_files["JSON or CSV files"]

node_operator -->|"selects scan"| node_commands
node_commands -->|"dispatches"| node_github_adapter
node_commands -->|"dispatches"| node_gitlab_adapter
node_github_adapter -->|"starts scan"| node_scan_runner
node_gitlab_adapter -->|"starts scan"| node_scan_runner
node_github_adapter -->|"lists repositories"| node_github_api
node_gitlab_adapter -->|"lists repositories"| node_gitlab_api
node_scan_runner -->|"requests repositories"| node_github_adapter
node_scan_runner -->|"requests repositories"| node_gitlab_adapter
node_scan_runner -->|"clones repositories"| node_git_ops
node_git_ops -->|"fetches refs"| node_git_remote
node_git_ops -->|"creates or updates"| node_working_copy
node_scan_runner -->|"scans repository"| node_trufflehog
node_scan_runner -->|"scans repository"| node_gitleaks
node_trufflehog -->|"executes"| node_trufflehog_bin
node_gitleaks -->|"executes"| node_gitleaks_bin
node_scan_runner -->|"excludes prior findings"| node_baseline
node_scan_runner -->|"drops ignored findings"| node_fingerprints
node_scan_runner -->|"unions findings"| node_secret_model
node_scan_runner -->|"writes findings"| node_report_writer
node_report_writer -->|"creates report"| node_report_files
node_scan_runner -->|"runs tasks"| node_progress

click node_commands "https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/scm.go"
click node_github_adapter "https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/github.go"
click node_gitlab_adapter "https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/gitlab.go"
click node_scan_runner "https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/scan.go"
click node_git_ops "https://github.com/padok-team/git-secret-scanner/blob/main/internal/scm/git/clone.go"
click node_trufflehog "https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/scanners/trufflehog/scanner.go"
click node_gitleaks "https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/scanners/gitleaks/scanner.go"
click node_baseline "https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/baseline.go"
click node_fingerprints "https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/fingerprints.go"
click node_secret_model "https://github.com/padok-team/git-secret-scanner/blob/main/internal/report/secret/secret.go"
click node_report_writer "https://github.com/padok-team/git-secret-scanner/tree/main/internal/report"
click node_progress "https://github.com/padok-team/git-secret-scanner/blob/main/internal/progress/task.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_commands toneBlue
class node_github_adapter,node_gitlab_adapter toneAmber
class node_scan_runner,node_git_ops,node_trufflehog,node_gitleaks,node_baseline,node_fingerprints,node_progress,node_github_api,node_gitlab_api toneMint
class node_secret_model,node_report_writer toneRose
class node_operator,node_git_remote,node_working_copy,node_trufflehog_bin,node_gitleaks_bin,node_report_files toneIndigo
```

## Components

### CLI entry

- [Scan commands](https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/scm.go): `cmd/scan/scm.go`

### SCM providers

- [GitHub adapter](https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/github.go): `cmd/scan/github.go`
- [GitLab adapter](https://github.com/padok-team/git-secret-scanner/blob/main/cmd/scan/gitlab.go): `cmd/scan/gitlab.go`

### Scanning and filtering

- [Scan coordinator](https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/scan.go): `internal/scan/scan.go`
- [Git operations](https://github.com/padok-team/git-secret-scanner/blob/main/internal/scm/git/clone.go): `internal/scm/git/clone.go`
- [TruffleHog scanner](https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/scanners/trufflehog/scanner.go): `internal/scan/scanners/trufflehog/scanner.go`
- [Gitleaks scanner](https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/scanners/gitleaks/scanner.go): `internal/scan/scanners/gitleaks/scanner.go`
- [Baseline filtering](https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/baseline.go): `internal/scan/baseline.go`
- [Fingerprint filtering](https://github.com/padok-team/git-secret-scanner/blob/main/internal/scan/fingerprints.go): `internal/scan/fingerprints.go`
- [Task progress](https://github.com/padok-team/git-secret-scanner/blob/main/internal/progress/task.go): `internal/progress/task.go`

### Results

- [Secret model](https://github.com/padok-team/git-secret-scanner/blob/main/internal/report/secret/secret.go): `internal/report/secret/secret.go`
- [Report writers](https://github.com/padok-team/git-secret-scanner/tree/main/internal/report): `internal/report`

### Other components

- **Operator**
- **GitHub API**
- **GitLab API**
- **Git remotes**
- **Working copies**
- **TruffleHog binary**
- **Gitleaks binary**
- **JSON or CSV files**

## Connections

- Operator → Scan commands: selects scan
- Scan commands → GitHub adapter: dispatches
- Scan commands → GitLab adapter: dispatches
- GitHub adapter → Scan coordinator: starts scan
- GitLab adapter → Scan coordinator: starts scan
- GitHub adapter → GitHub API: lists repositories
- GitLab adapter → GitLab API: lists repositories
- Scan coordinator → GitHub adapter: requests repositories
- Scan coordinator → GitLab adapter: requests repositories
- Scan coordinator → Git operations: clones repositories
- Git operations → Git remotes: fetches refs
- Git operations → Working copies: creates or updates
- Scan coordinator → TruffleHog scanner: scans repository
- Scan coordinator → Gitleaks scanner: scans repository
- TruffleHog scanner → TruffleHog binary: executes
- Gitleaks scanner → Gitleaks binary: executes
- Scan coordinator → Baseline filtering: excludes prior findings
- Scan coordinator → Fingerprint filtering: drops ignored findings
- Scan coordinator → Secret model: unions findings
- Scan coordinator → Report writers: writes findings
- Report writers → JSON or CSV files: creates report
- Scan coordinator → Task progress: runs tasks