def detect_secrets():
    """
    Call detect-secrets tool
    """
    # use
    # blah blah = "foo"     # pragma: whitelist secret
    # to ignore a false posites
    errors_file = "detect-secrets-results.txt"

    print(execute_get_text("pwd"))

    command = "{0} detect-secrets --scan --base64-limit 4 --exclude .idea|.js|.min.js|.html|.xsd|" \
              "lock.json|synced_folders|.scss|Pipfile.lock|" \
              "lint.txt|{1}".format(PIPENV, errors_file).strip()
    print(command)
    bash_process = subprocess.Popen(command.split(" "),
                                    #shell=True,
                                    stdout=subprocess.PIPE,
                                    stderr=subprocess.PIPE
                                    )
    foo = bash_process.wait()
    out, err = bash_process.communicate()  # wait


    with open(errors_file, "w+") as file_handle:
        if len(out)==0:
            print("Warning- no output from detect secrets. Happens with git hook, but not from ordinary command line.")
            return
        file_handle.write(out.decode())



    with open(errors_file) as f:
        try:
            data = json.load(f)
        except Exception:
            print("Can't read json")
            exit(-1)
            return

    if data["results"]:
        for result in data["results"]:
            print(result)
        print("detect-secrets has discovered high entropy strings, possibly passwords?")
        exit(-1)
Call detect-secrets tool