-
Notifications
You must be signed in to change notification settings - Fork 252
Description
Describe the bug
In a Golang project with submodules (subfolders containing additional go.mod
and go.sum
folders) talisman is since 1.33.0 no longer ignoring go.sum
files in the subfolders during scan with the Golang scope set in the .talismanrc
file.
To Reproduce
Steps to reproduce the behavior:
- Checkout this simple example project.
- Execute
talisman -s --ignoreHistory
with talisman version 1.32.2 - The resulting report will have no findings.
- Execute
talisman -s --ignoreHistory
with talisman version 1.33.0 - The resulting report will report findings in the
./sub1/go.sum
file
Expected behavior
The behaviour of integrated file ignores via the Golang scope setting should not have changed between those versions. A scan with either version should not report any findings in the above example.
Screenshots
The example project contains example report outputs generated with talisman version 1.32.2 and 1.33.0.
Additional context
I was able to resolve this when building locally by prefixing the go.sum
string in the knownScopes with *
just as it was done with the lock.hcl file here.