"--exclude" flag not working

[MrStacks]

#!/bin/bash
# gitguardian-scan.sh

# Colors for output (optional)
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Function to detect platform and provide appropriate Docker parameter
detect_platform() {
    local os arch
    os=$(uname -s)
    arch=$(uname -m)

    # Debug messages go to stderr
    echo -e "${BLUE}Detecting platform: ${os} ${arch}${NC}" >&2

    local platform_arg=""
    if [ "$os" = "Darwin" ] && [ "$arch" = "arm64" ]; then
        echo -e "${BLUE}Detected ARM-based Mac${NC}" >&2
        platform_arg="--platform=linux/amd64"
    elif [ "$os" = "Linux" ]; then
        echo -e "${BLUE}Detected Linux system${NC}" >&2
    elif [[ "$os" == *"MINGW"* ]] || [[ "$os" == *"MSYS"* ]] || [[ "$os" == *"CYGWIN"* ]]; then
        echo -e "${BLUE}Detected Windows system${NC}" >&2
    else
        echo -e "${BLUE}Detected system: ${os} ${arch}${NC}" >&2
    fi
    echo "$platform_arg"
}

# Get API key from Secret Manager if not provided
if [ -z "$GITGUARDIAN_API_KEY" ]; then
    echo "Retrieving API key from Secret Manager..."
    GITGUARDIAN_API_KEY=$(gcloud secrets versions access latest --secret=gitguardian-api-key)
    if [ -z "$GITGUARDIAN_API_KEY" ]; then
        echo "Failed to retrieve API key!"
        exit 1
    fi
fi

# Default to scanning everything if no directory specified
SCAN_DIRS=("${@:-.}")
DIRS_TO_SCAN=""

for dir in "${SCAN_DIRS[@]}"; do
    # Append without leading extra space if empty
    if [ -z "$DIRS_TO_SCAN" ]; then
        DIRS_TO_SCAN="/src/$dir"
    else
        DIRS_TO_SCAN="$DIRS_TO_SCAN /src/$dir"
    fi
done

# Determine additional Docker parameters based on platform (trim any extra whitespace)
DOCKER_PLATFORM=$(detect_platform | xargs)

# Check if .gitguardian.yaml is found in the container mount (at /src)
if [ -f "$(pwd)/.gitguardian.yaml" ]; then
    echo "Found .gitguardian.yaml at /src/.gitguardian.yaml"
else
    echo "WARNING: .gitguardian.yaml not found at /src/.gitguardian.yaml"
fi

# Run the scan using the official Docker Hub image
docker run --rm \
    "$DOCKER_PLATFORM" \
    -v "$(pwd):/src" \
    -e GITGUARDIAN_API_KEY="$GITGUARDIAN_API_KEY" \
    gitguardian/ggshield:latest \
    ggshield secret scan path \
    "--recursive" "-y" \
    "--exclude" "**/.pnpm-store/**" \
    "--exclude" "**/.pnpm-store" \
    "--exclude" ".pnpm-store/**" \
    "--exclude" ".pnpm-store" \
    "--exclude" "**/node_modules/**" \
    "--exclude" "**/node_modules" \
    "--exclude" "node_modules/**" \
    "--exclude" "node_modules" \
    "--exclude" "**/dist/**" \
    "--exclude" "**/dist" \
    "--exclude" "dist/**" \
    "--exclude" "dist" \
    "--exclude" "**/build/**" \
    "--exclude" "**/build" \
    "--exclude" "build/**" \
    "--exclude" "build" \
    "--verbose" \
    "$DIRS_TO_SCAN"
exit $?

I've tried many variations but .pnpm-store (full of big log files) keeps getting scanned and nearly crashes my scan. It makes the scan untenable. Project root located .gitguardian.yaml:

YAML
version: 2
exit_zero: true
verbose: true

secret:
  # Exclude files and paths by globbing
  ignored_paths:
    # Package management
    - "**/node_modules/**"
    - "**/.pnpm-store/**"
    - ".pnpm-store/**"
    - ".pnpm-store"
    - "*/.pnpm-store/*"
    - "**/.pnpm-store"
    - "**/pnpm-lock.yaml"
    - "**/package-lock.json"
    - "**/yarn.lock"

    # Build outputs
    - "**/dist/**"
    - "**/build/**"
    - "**/coverage/**"

    # Large files and binaries
    - "**/*.jpg"
    - "**/*.png"
    - "**/*.gif"
    - "**/*.svg"
    - "**/*.zip"
    - "**/*.tar.gz"
    - "**/*.min.js"
    - "tools/bin/*"

    # Cache directories
    - "**/.cache/**"

    # Environment files
    - ".env.local"
    - ".env.*.local"

    # Test fixtures
    - "test/fixtures/**"

  show_secrets: false
  ignore_known_secrets: false
  ignored_matches:
    - name: "Test checksums"
      match: 'CONFTEXT_CHECKSUM="your-expected-checksum-value-for-conftest-v0.42.1"'

A sample of my huge printout:

• /src/.pnpm-store/v10/files/2b/48c029e8ac3e4e9548a88fc94856fd034e79dcc0d1d63c3e6491741a3df7886043f5c22e3ae9490a2be95ba8bb72b65d4fd72d328e511c05f12fbdaf190215
• /src/.pnpm-store/v10/files/fe/e13bae561c5085ffed056a363f911faee3bd8ee1e1ed30a0c84a5cc57bd0ade92e60e36cdffc11f332e0c3c1aa1a21f95e7063e17a482145ee4e736a9fa4e5
• /src/.pnpm-store/v10/files/73/3d1ebc1cfd1579706e6faf63b94ccdbf11539c69c0018bf38bd6c5590338d23f673d62d906b02b7e10bfc2364420aa84f145923f1dad5e7ee08eedace4855f
• /src/.pnpm-store/v10/files/8f/2f53de7ef2c7295aded41119669068ef9a0c319947154fe13ea9da84735be89bc6cb93a1c66090cf725b4be066df971fdfedab88ab2a8354668aa9f2735075
• /src/.pnpm-store/v10/index/55/751d812894ac4fd66579fa814215548b20d3e1e9e953d93ce68709acbe3ae1-re2-wasm@1.0.2.json
• /src/.pnpm-store/v10/files/d9/95ede384dfd0971a4bf60c1e4e7dce7209fe0612ae4fd4f71764844b7091ec58c3d5d28fa17df8713f5efef8f60cd9cdb308d53f007f9475346b4deffd01ad
• /src/.pnpm-store/v10/files/19/7536ffa87cea89d15816caf37d38af73a8e4844a44ff7339c232438d3bce642076fd4d684baf82f28341799eb8e9576b9dbaa7142d8a1d6140f50dd69058f3
  Starting scan

---

Skipped file:///src/.pnpm-store/v10/files/fa/fa48d2a0e5655fd263a13e58ea4397b6d127afa0de04e1616055baa2e264a8ad7c82f634b0ae5f1e470f4305a0d95f9080a761f1e4e9b792a61e85ef57c8fc: content is over 1,048,576 bytes
Skipped file:///src/.pnpm-store/v10/files/d2/a8199ab835449049deb766340444a5ff8bf6decc38f86ef58362de079c54ac3ff1a2c6708f58303ca47908e7e90176e351448c56a6968130753a5879b82da7: can't detect encoding
Warning: Rate-limit hit, retrying in 55 seconds
Skipped file:///src/.pnpm-store/v10/files/60/332e0cbb3ad5f650562b0df9ef055e9a1ad5c2884ec839f5261675b59c405379eb1915ef292f62d898e9ea976338f90f6ec67f4745224094ddeeafd9fd840b: can't detect encoding
Skipped file:///src/.pnpm-store/v10/files/96/5fe0c76aa794f4ec543186a70f5c724a051683feb8e40f644fc6cbe5e375f2d11c7061af761be5a5c6c9891af9bf90fe4f948b7a2256330cd103a96aa5467b: content is over 1,048,576 bytes
Skipped file:///src/.pnpm-store/v10/files/b4/009905710fca6de239450306893480d8c5cb6ee11ade8a53602b64a057c70176a833bd3a81c8dc5bfe58d1837f57b89eb815fe247a2d81cbc4915f6f8dd0d9: can't detect encoding