spec:
  inputs:
    stage:
      default: test
    image_prefix:
      default: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
    image_tag:
      default: '7'
    image_suffix:
      default: ""
---

secret_detection:
  stage: $[[ inputs.stage ]]
  image: "$[[ inputs.image_prefix ]]/secrets:$[[ inputs.image_tag ]]$[[ inputs.image_suffix ]]"
  services: []
  allow_failure: true
  variables:
    GIT_DEPTH: "50"
    SECRET_DETECTION_EXCLUDED_PATHS: ""
  # `rules` must be overridden explicitly by each child job
  # see https://gitlab.com/gitlab-org/gitlab/-/issues/218444
  artifacts:
    reports:
      secret_detection: gl-secret-detection-report.json
  rules:
    - if: $CI_COMMIT_BRANCH
  script:
    - /analyzer run