.gitguardian.example.yml

# Required, otherwise ggshield considers the file to use the deprecated v1 format
version: 2

# Set to true if the desired exit code for the CLI is always 0, otherwise the
# exit code will be 1 if incidents are found.
# The environment variable GITGUARDIAN_EXIT_ZERO=true can also be used toggle this behavior.
exit-zero: false # default: false

verbose: false # default: false

# The dashboard URL of the instance
instance: https://dashboard.gitguardian.com # default: https://dashboard.gitguardian.com

# Maximum commits to scan in a hook.
max-commits-for-hook: 50 # default: 50

# Accept self-signed certificates for the API.
allow-self-signed: false # default: false

secret:
  # Exclude files and paths by globbing
  ignored-paths:
    - '**/README.md'
    - 'doc/*'
    - 'LICENSE'

  # Ignore security incidents with the SHA256 of the occurrence obtained at output or the secret itself
  ignored-matches:
    - name:
      match: 530e5a4a7ea00814db8845dd0cae5efaa4b974a3ce1c76d0384ba715248a5dc1
    - name: credentials
      match: MY_TEST_CREDENTIAL

  show-secrets: false # default: false

  # Detectors to ignore.
  ignored-detectors: # default: []
    - Generic Password

iac:
  # Exclude files and paths by globbing
  ignored-paths:
    - '**/README.md'
    - 'doc/*'
    - 'LICENSE'
    - path: 'tests/*'
      comment: 'Ignore vulnerabilities in tests'
    - path: 'dev/*'
      comment: 'Ignore vulnerabilities in dev sandbox'
      until: '2030-06-24T00:00:01Z'

  # IaC vulnerabilities to ignore
  ignored-policies:
    - GG_IAC_0000
    - GG_IAC_0005
    - policy: 'GG_IAC_0003'
      until: '2030-06-24T00:00:01Z'
    - policy: 'GG_IAC_0012'
      comment: 'We will handle this later'
      until: '2030-06-24T00:00:01Z'

  # Minimum severity of the policies
  minimum-severity: HIGH

sca:
  # Exclude files and paths by globbing
  ignored-paths:
    - '**/Pipfile'
    - '/back/**/package.json'

  # SCA vulnerabilities to ignore
  ignored-vulnerabilities:
    - identifier: 'GHSA-0000-aaaa-ZZZZ'
      path: 'Pipfile.lock' # Can be a regex
      comment: 'Check vulnerability later' # Optional
      until: '2023-05-01T00:00:00' # Optional, needs to follow ISO 8061 format 'YYYY-MM-DDTHH:MM:SS' (converted to UTC)

  # Minimum severity of the policies
  minimum-severity: HIGH