2 ms·
Even if the secret is added then deleted?
by oodelally 6y ago
Even if the secret is added then deleted?
- mytailorisrich 6y agoFor the secret to be added it must pass code review as the point is to vet what is added to the repository. If at the point of the review that code has already found its way into the repository, which should then be purged, that is an action that can be taken when the secret is found during review. Granted that means a manual operation, but obviously only when a secret is found, which should hardly ever happen if everyone is clear about internal coding rules and basic security (which the team should be).
- pawelmor 6y agoSome people only review the final diff and don't go through the code commit by commit.
- mytailorisrich 6y agoThere should be only a single commit, vetted by the code review. What happens before on a private branch (usually on a local copy of the repo) can be purged (and probably should be purged as a matter of course) if there is a worry of what might be contained in there. The bottom line for is that the most important is to define a good process first before trying to use tooling to correct process deficiencies. A good process brings many benefits by 'forcing' good outcomes and avoid a lot of headaches.
- pawelmor 6y agoI completely agree that this is how the review should be done. But this is not the case in all companies.
- mytailorisrich 6y ago> But this is not the case in all companies. In that case it's worth fixing the process before adding layers of tooling.
- oodelally 6y agoNot the current state of the world!
- deleted 6y ago[deleted]
- oodelally 6y agoNo you can add and delete without going through code review. And this is was happens most of the time as we're all constantly committing deletions and additions that we push on a feature branch for example before it is being reviewed and merged.