Staging

gsast-core/gsast_core/configs/__init__.py

@@ -25,6 +25,7 @@
     SERVER_CHECK_PROJECT_STATUS_INTERVAL,
     SERVER_JOB_TIMEOUT,
     SERVER_JOB_RESULT_TTL,
+    REDIS_SCAN_RESULTS_TTL,
     REDIS_CACHE_DB,
     REDIS_TASKS_DB,
     REDIS_RULES_DB,

gsast-core/gsast_core/configs/defaults.py

@@ -26,6 +26,8 @@
 SERVER_JOB_TIMEOUT: str = '15m'  # minutes
 SERVER_JOB_RESULT_TTL: int = 3 * 60 * 60 * 24  # seconds
 
+REDIS_SCAN_RESULTS_TTL: int = 7 * 24 * 60 * 60  # 7 days in seconds
+
 REDIS_CACHE_DB: int = 0
 REDIS_TASKS_DB: int = 1
 REDIS_RULES_DB: int = 2

gsast-core/gsast_core/sastlib/results_storage.py

@@ -3,6 +3,7 @@
 from typing import Dict, Optional, Any, List
 from pathlib import Path
 from redis.client import Redis
+from gsast_core.configs import REDIS_SCAN_RESULTS_TTL
 from gsast_core.utils.safe_logging import log
 
 
@@ -57,10 +58,12 @@ def store_scan_results(scans_redis: Redis, scan_id: str, project_url: str, scann
             'scanner_type': scanner_type,
             'updated_at': str(int(time.time()))
         })
+        scans_redis.expire(results_key, REDIS_SCAN_RESULTS_TTL)
 
         # Add this project to the scan's project list
         projects_key = f"{scan_id}:projects"
         scans_redis.sadd(projects_key, project_url)
+        scans_redis.expire(projects_key, REDIS_SCAN_RESULTS_TTL)
 
         log.info(f"Successfully stored {len(results_paths)} {scanner_type} results for {project_url}")
         return True

helm/gsast/templates/_helpers.tpl

@@ -77,6 +77,10 @@ Common environment variables for both API and Worker
 - name: NO_PROXY
   value: {{ .Values.environment.noProxy }}
 {{- end }}
+{{- if .Values.environment.trufflehogOnlyVerified }}
+- name: TRUFFLEHOG_ONLY_VERIFIED
+  value: {{ .Values.environment.trufflehogOnlyVerified | quote }}
+{{- end }}
 - name: GITHUB_API_TOKEN
   valueFrom:
     secretKeyRef:

helm/gsast/values.yaml

@@ -28,6 +28,10 @@ environment:
   httpsProxy: null
   noProxy: null
 
+  # TruffleHog configuration
+  # Set to "false" to include unverified secrets, "true" for only verified secrets
+  trufflehogOnlyVerified: "true"
+
   # Custom GitLab CA configuration
   customGitlabCA:
     enabled: false