DotGitignore-like Include Paths

[dclayton-godaddy]

Feature Request

Add --ignore-paths to support git-like ignore syntax.

NOTE: I have already started development on this so immediate feedback is appreciated.

Is your feature request related to a problem? Please describe.

--excluded-paths and --included-paths point to files containing paths to ignore or scan. My immediate thought is that the paths are similar to .dockerignore, .gitignore, etc. However they are regular expressions which are more painful to write.

Describe the solution you'd like

Add --ignore-paths .secretsignore to the CLI that is modeled after other ignore files like .gitignore or .dockerignore. .gitignore and .dockerignore support negating ! whereby this acts as an include, so there is no need for another file to include paths.

.secretsignore

.git/
node_modules/
package-lock.json
yarn.lock

only include YAML files

*
!**/*.yaml

Describe alternatives you've considered

--excluded-paths

Teachability, Documentation, Adoption, Migration Strategy

[tarkatronic]

I'm initially pretty hesitant to implement this. It is currently pretty well documented that these use regular expressions, and regexes are currently the convention throughout this application. For example, in the output from tartufo --help:

  -i, --include-paths FILENAME    File with regular expressions (one per
                                  line), ...
  -x, --exclude-paths FILENAME    File with regular expressions (one per
                                  line), ...

I can understand the urge to use glob-style syntax, but I think that would be overall more of a step backward than a step forward. Also, I'm pretty sure that we nowhere imply nor state that this is using glob/ignore syntax.

[dclayton-godaddy]

Sure. I don't recall the last time I used a file with one path per line that was not a git-like syntax. The more we are consistent with other tools, the easier it will be to implement.

[dclayton-godaddy]

To me, this is easier to read and since I know .gitignore syntax, I already know how to include files/folders. I won't accidentally put yarn.lock and forget . is a wildcard for any character.

.git/
node_modules/
package-lock.json
yarn.lock