detect-secrets baseline out of date / modified in CI

By Kaveh Alemi·Latchkey

A CI check re-runs detect-secrets scan and compares the result to the committed .secrets.baseline. If they differ, for example a secret was added or a plugin version changed, the baseline is out of date and the check fails.

What this error means

The CI step reports that the baseline file was modified during the scan, or that it is out of date, and asks you to run detect-secrets scan --baseline .secrets.baseline and commit the result.

The baseline file was modified by a scan.
Please run:  detect-secrets scan --baseline .secrets.baseline
and commit the updated .secrets.baseline.
Error: Process completed with exit code 1

Common causes

The repository changed but the baseline was not updated

New files or lines introduced findings (or removed old ones), so a fresh scan produces a different baseline than the committed one.

A detect-secrets version or plugin change

Upgrading detect-secrets can change plugin fingerprints or ordering, so the regenerated baseline differs even without code changes.

How to fix it

Regenerate and commit the baseline

1. Run the scan with --baseline so existing audited decisions are preserved.
2. Review the diff to confirm no real secret was added.
3. Commit the updated .secrets.baseline.

detect-secrets scan --baseline .secrets.baseline
git add .secrets.baseline

Pin the detect-secrets version

Pin the tool so plugin fingerprints stay stable and the baseline does not drift on unrelated runs.

detect-secrets==1.5.0

How to prevent it

• Regenerate the baseline in the same PR that adds findings.
• Pin the detect-secrets version to avoid fingerprint drift.
• Review baseline diffs so new real secrets are never rubber-stamped.

Frequently asked questions

Related guides

References

• GitHub Actions documentation