Skip to content

Golang scope files not ignored in submodules since 1.33.0 #476

@Sheldoras

Description

@Sheldoras

Describe the bug
In a Golang project with submodules (subfolders containing additional go.mod and go.sum folders) talisman is since 1.33.0 no longer ignoring go.sum files in the subfolders during scan with the Golang scope set in the .talismanrc file.

To Reproduce
Steps to reproduce the behavior:

  1. Checkout this simple example project.
  2. Execute talisman -s --ignoreHistory with talisman version 1.32.2
  3. The resulting report will have no findings.
  4. Execute talisman -s --ignoreHistory with talisman version 1.33.0
  5. The resulting report will report findings in the ./sub1/go.sum file

Expected behavior
The behaviour of integrated file ignores via the Golang scope setting should not have changed between those versions. A scan with either version should not report any findings in the above example.

Screenshots
The example project contains example report outputs generated with talisman version 1.32.2 and 1.33.0.

Additional context
I was able to resolve this when building locally by prefixing the go.sum string in the knownScopes with * just as it was done with the lock.hcl file here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions