detect-secrets audit "unaudited" baseline entries block CI

By Daniel Zoghalchali·Latchkey

A stricter CI gate requires every entry in .secrets.baseline to be audited (marked as a true or false positive). Entries with is_secret: null are unaudited, so the audit check fails until a human decides.

What this error means

The pipeline reports that the baseline contains unaudited entries, or detect-secrets audit --report lists results with no is_secret decision, and the step exits non-zero.

detect-secrets audit --report --fail-on-unaudited .secrets.baseline
2 unaudited results found. Run: detect-secrets audit .secrets.baseline
Error: Process completed with exit code 1

Common causes

New baseline entries were never audited

A scan added findings to the baseline, but nobody ran detect-secrets audit to mark each as a real secret or a false positive.

A CI policy that requires audited baselines

The gate enforces that every recorded finding has a decision, so is_secret: null entries fail the check.

How to fix it

Audit each entry and commit the decisions

1. Run detect-secrets audit .secrets.baseline and step through each finding.
2. Mark real secrets for removal and rotation; mark verified non-secrets as false positives.
3. Commit the updated baseline so every entry is audited.

detect-secrets audit .secrets.baseline
git add .secrets.baseline

Report the audit status in CI

Use the report mode to list unaudited entries clearly instead of failing with no context.

detect-secrets audit --report .secrets.baseline

How to prevent it

• Audit new baseline entries in the PR that introduces them.
• Keep the baseline small so audits stay manageable.
• Treat any real secret found during audit as compromised and rotate it.

Frequently asked questions

Related guides

References

• GitHub Actions documentation