[INS-461] Add test to ensure new detectors are registered in defaults.go#4915
Open
mustansir14 wants to merge 2 commits intomainfrom
Open
Conversation
MuneebUllahKhan222
approved these changes
Apr 23, 2026
Contributor
MuneebUllahKhan222
left a comment
There was a problem hiding this comment.
This test should have been there all along but I guess better late than never. Great Work!
amanfcp
approved these changes
Apr 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
TruffleHog has over 1,000 defined
DetectorTypeproto enum entries, each corresponding to a secret detector. ThebuildDetectorList()function inpkg/engine/defaults/defaults.gois the single place where all active detectors are registered and made available to the engine. However, there was no CI check to verify that a newly written detector is actually registered there. A developer could write a complete, working detector — with its own package,Scannerstruct, keywords, andType()— and simply forget to add it tobuildDetectorList(), causing it to silently never run.What changed
TestAllDetectorTypesAreInDefaultListis added topkg/engine/defaults/defaults_test.go. It iterates over everyDetectorTypedefined in the protobuf enum and asserts that each one is either:DefaultDetectors(), orexcludedFromDefaultListwith a documented reason.A reverse check is also included: if a type is in
excludedFromDefaultListbut is also present in the active list, the test fails. This catches stale exclude-list entries (e.g. a detector that was once disabled but has since been re-enabled).The
excludedFromDefaultListmap groups excluded types into four categories:CustomRegex, which is added dynamically via engine configdeprecated=true; the underlying service no longer exists or has been supersededbuildDetectorList()due to API issues, false positives, or expired service domainsDetectors found to be unregistered
Running the test immediately surfaced detectors with full implementations that were never added to
buildDetectorList():BitbucketDataCenter(this is added in #4907 ),DatadogApikey,Guru,IPInfo,Lob,Rev,TLy,Tru,User,WitThese detectors are not added to
buildDetectorList()in this PR. Enabling a detector that has never been active is a customer-facing change: it can produce noise, and this is something we have been careful about while adding new detectors. Each detector should be enabled in a dedicated PR after:In the meantime, these types are tracked in
excludedFromDefaultListunder aTODOcomment so the gap remains visible and the test continues to pass.Checklist:
make test-community)?make lintthis requires golangci-lint)?Note
Low Risk
Test-only change that adds CI coverage for detector registration; no runtime behavior changes, but the large exclusion list will need ongoing maintenance as enum values evolve.
Overview
Adds
TestAllDetectorTypesAreInDefaultListto enforce that every protobufDetectorTypeis either returned byDefaultDetectors()(i.e., registered inbuildDetectorList()), or is explicitly listed in a newexcludedFromDefaultListmap.The test also performs a reverse check to fail if an excluded type is actually active, and seeds
excludedFromDefaultListwith grouped reasons (reserved/special, deprecated, intentionally disabled, not-yet-implemented, plus a TODO set of implemented-but-not-registered detectors) to prevent silent omissions when new detector enums are added.Reviewed by Cursor Bugbot for commit c4a392f. Bugbot is set up for automated code reviews on this repo. Configure here.