Last week I got a tip from a colleague(Thx Sam!). During a ‘Tech sync’ we were discussing on how to avoid committing secrets in your source repository. Of course there exists tools that scan for credentials inside your repository but these tools have to be configured and are not perfect.
Another way to do this by introducing a Reviewer policy together with a path filter in Azure DevOps. By setting a path filter, the branch policy is only applied when files matching the filter are changed.
Typical places where application secrets are added are config files, application settings, … Let’s define some paths to check:
/Config/**.json*.config
To combine multiple paths you can use ; as a separator:
/Config/*;*.json;*.config
To apply this configuration for a repository, go to the cross repositories settings (e.g. /_settings/repositories">https://dev.azure.com/<organization name>/_settings/repositories).
Go to the ‘Automatically include code reviewers’ section and click on the ‘+’ sign.
Select the reviewers you want to add and enter the path filter in the ‘For pull requests affecting these folders’ field:
More information: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops#path-filters